HTTP request smuggling In python-aiohttp
Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | 3.7.4-1+deb11u1 | ||
debian 13 | 3.10.11-1 | ||
 pypi | 3.10.11 | ||
debian 12 | 3.8.4-1+deb12u1 | ||
debian 14 | 3.10.11-1 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8.
References
1. 2.