https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 01:50:34 +0000 https://vulnerability.circl.lu/vuln/cve-2023-49082 <p><strong>Affected:</strong> aio-libs aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.</p> <p><strong>Affected:</strong> aio-libs aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.</p> https://vulnerability.circl.lu/vuln/cve-2023-49082 https://vulnerability.circl.lu/vuln/usn-7642-1 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp</p> <p>Ben Kallus discovered that AIOHTTP did not correctly parse HTTP headers. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-47627)</p> <p>Ivan Novikov discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)</p> <p>Paul J. Dorn discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-23829)</p> <p>Takeshi Kaneko discovered that AIOHTTP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. (CVE-2024-27306)</p> <p>It was discovered that AIOHTTP did not correctly handle certain POST requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30251)</p> <p>Jeppe Bonde Weikop discovered that AIOHTTP did not correctly handle parsing newlines in certain inputs. A remote attacker could possibly use this issue to perform request smuggling. (CVE-2024-52304)</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp</p> <p>Ben Kallus discovered that AIOHTTP did not correctly parse HTTP headers. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-47627)</p> <p>Ivan Novikov discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)</p> <p>Paul J. Dorn discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-23829)</p> <p>Takeshi Kaneko discovered that AIOHTTP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. (CVE-2024-27306)</p> <p>It was discovered that AIOHTTP did not correctly handle certain POST requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30251)</p> <p>Jeppe Bonde Weikop discovered that AIOHTTP did not correctly handle parsing newlines in certain inputs. A remote attacker could possibly use this issue to perform request smuggling. (CVE-2024-52304)</p> https://vulnerability.circl.lu/vuln/usn-7642-1