https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T03:10:18.714628+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2023-47627 CVE-2023-47627 — Request smuggling in aiohttp 2026-09-30T03:10:19.458478+00:00

Affected: aio-libs aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.

 https://vulnerability.circl.lu/vuln/usn-7642-1 USN-7642-1 — python-aiohttp vulnerabilities 2026-09-30T03:10:19.458584+00:00

Affected: Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp

Ben Kallus discovered that AIOHTTP did not correctly parse HTTP headers. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-47627)

Ivan Novikov discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)

Paul J. Dorn discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-23829)

Takeshi Kaneko discovered that AIOHTTP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. (CVE-2024-27306)

It was discovered that AIOHTTP did not correctly handle certain POST requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30251)

Jeppe Bonde Weikop discovered that AIOHTTP did not correctly handle parsing newlines in certain inputs. A remote attacker could possibly use this issue to perform request smuggling. (CVE-2024-52304)