Dependency scanning
Check whether aiohttp is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Vulnerabilities
CVE-2026-54279
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
CVE-2026-111063
AIOHTTP: Secure attribute not enforced for shared cookie
CVE-2026-111065
AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111748
AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-111749
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
CVE-2026-111750
AIOHTTP: Pure-Python parser request smuggling
CVE-2026-111066
AIOHTTP: File descriptor exhaustion in multipart requests
CVE-2026-111064
aiohttp server lacks an initial request/header timeout
GHSA-2g87-pp6c-29x5
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
CVE-2026-59881
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
CVE-2026-69243
AIOHTTP: HTTP request smuggling via WebSocket upgrade
CVE-2026-69244
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
CVE-2026-50269
aiohttp: CRLF injection in multipart headers
CVE-2026-34993
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
CVE-2026-54278
aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
CVE-2026-54273
aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
CVE-2026-22815
aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage
CVE-2026-34515
AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
CVE-2026-34516
AIOHTTP has a Multipart Header Size Bypass
CVE-2026-34513
AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
CVE-2026-34525
AIOHTTP accepts duplicate Host headers
CVE-2026-34518
AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect
CVE-2026-54280
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
CVE-2026-54276
aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
CVE-2026-47265
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
CVE-2026-54277
aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
CVE-2026-54275
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
CVE-2026-34519
AIOHTTP has HTTP response splitting via \r in reason phrase
CVE-2026-34520
AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass
CVE-2026-34517
AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS
CVE-2026-34514
AIOHTTP has CRLF injection through multipart part content type header construction
CVE-2025-69225
AIOHTTP has unicode match groups in regexes for ASCII protocol elements
CVE-2025-69227
AIOHTTP vulnerable to DoS when bypassing asserts
CVE-2025-69229
AIOHTTP vulnerable to DoS through chunked messages
CVE-2025-69230
AIOHTTP Vulnerable to Cookie Parser Warning Storm
CVE-2025-69228
AIOHTTP vulnerable to denial of service through large payloads
CVE-2025-69223
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
CVE-2025-69226
AIOHTTP vulnerable to brute-force leak of internal static file path components
CVE-2025-53643
AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections
CVE-2024-52304
aiohttp allows request smuggling due to incorrect parsing of chunk extensions
CVE-2024-52303
aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method
CVE-2024-42367
In aiohttp, compressed files as symlinks are not protected from path traversal
CVE-2024-30251
aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
CVE-2026-54274
aiohttp: Incomplete websocket frame payloads bypass memory limits
CVE-2024-27306
aiohttp Cross-site Scripting vulnerability on index pages for static file handling
CVE-2024-23829
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
CVE-2024-23334
aiohttp is vulnerable to directory traversal
GHSA-pjjw-qhg8-p2p9
aiohttp has vulnerable dependency that is vulnerable to request smuggling
CVE-2023-49082
aiohttp's ClientSession is vulnerable to CRLF injection via method
CVE-2023-47627
AIOHTTP has problems in HTTP parser (the python one, not llhttp)
CVE-2025-69224
AIOHTTP's unicode processing of header values could cause parsing discrepancies
CVE-2023-49081
aiohttp's ClientSession is vulnerable to CRLF injection via version
CVE-2023-37276
aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser
CVE-2026-59881
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
CVE-2026-69243
AIOHTTP: HTTP request smuggling via WebSocket upgrade
CVE-2026-69244
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
CVE-2026-22815
CVE-2026-22815
CVE-2026-34515
CVE-2026-34515
CVE-2026-34516
CVE-2026-34516
CVE-2026-34519
CVE-2026-34519
CVE-2026-34518
CVE-2026-34518
CVE-2026-34513
CVE-2026-34513
CVE-2026-34514
CVE-2026-34514
CVE-2026-34517
CVE-2026-34517
CVE-2026-54273
CVE-2026-54273
CVE-2026-54274
CVE-2026-54274
CVE-2026-50269
CVE-2026-50269
CVE-2026-47265
CVE-2026-47265
CVE-2026-54280
CVE-2026-54280
CVE-2026-54279
CVE-2026-54279
CVE-2026-54278
CVE-2026-54278
CVE-2026-54277
CVE-2026-54277
CVE-2026-54276
CVE-2026-54276
CVE-2026-34993
CVE-2026-34993
CVE-2026-34525
CVE-2026-34525
CVE-2026-34520
CVE-2026-34520
CVE-2021-21330
`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)
CVE-2025-69227
AIOHTTP vulnerable to DoS when bypassing asserts
CVE-2025-69229
AIOHTTP vulnerable to DoS through chunked messages
CVE-2025-69230
AIOHTTP Vulnerable to Cookie Parser Warning Storm
CVE-2025-53643
AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections
CVE-2025-69224
AIOHTTP's unicode processing of header values could cause parsing discrepancies
CVE-2025-69223
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
CVE-2024-52304
aiohttp allows request smuggling due to incorrect parsing of chunk extensions
CVE-2025-69228
AIOHTTP vulnerable to denial of service through large payloads
CVE-2024-27306
aiohttp Cross-site Scripting vulnerability on index pages for static file handling
CVE-2024-30251
aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
CVE-2025-69226
AIOHTTP vulnerable to brute-force leak of internal static file path components
CVE-2024-52303
aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method
CVE-2025-69225
AIOHTTP has unicode match groups in regexes for ASCII protocol elements
CVE-2024-42367
In aiohttp, compressed files as symlinks are not protected from path traversal
CVE-2026-54275
CVE-2026-54275
CVE-2022-33124
Withdrawn: Denial of Service in aiohttp
CVE-2022-33124
CVE-2022-33124
CVE-2023-47641
Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks
CVE-2024-23829
CVE-2024-23829
CVE-2024-23334
CVE-2024-23334
CVE-2023-49081
CVE-2023-49081
CVE-2023-49082
CVE-2023-49082
CVE-2023-47627
CVE-2023-47627
Browse more PyPI advisories
Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →
Ready to move
Start Securing
Free, no credit card | First findings in minutes