Vulnerability GHSA-pqxq-w44r-73xw
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
7 hours ago
October 20, 2026 at 07:52 PM UTC
AIOHTTP: Pure-Python parser request smuggling
0.1 - 3.14.3
0.1 - 3.14.3
Summary
AIOHTTP: Pure-Python parser request smuggling
Details
Summary
The pure Python parser is vulnerable to an HTTP request smuggling attack.
Impact
If users are using the Python parser (AIOHTTP_NO_EXTENSIONS, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack.
Workaround
Switch to the default C parser.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
7 hours ago
AIOHTTP: File descriptor exhaustion in multipart requests
2.0.0 - 3.14.3 GHSA-9xw5-w5jj-pvcg
2.0.0 - 3.14.3 GHSA-9xw5-w5jj-pvcg
High Risk
1 day ago
aiohttp server lacks an initial request/header timeout
0.1 - 3.14.3 GHSA-5wr8-gcqf-gqf3
0.1 - 3.14.3 GHSA-5wr8-gcqf-gqf3
Low Risk
1 day ago
AIOHTTP: Secure attribute not enforced for shared cookie
0.1 - 3.14.3 GHSA-494j-54xm-rwp3
0.1 - 3.14.3 GHSA-494j-54xm-rwp3
High Risk
1 day ago
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
0.1 - 3.14.3 GHSA-2g87-pp6c-29x5
0.1 - 3.14.3 GHSA-2g87-pp6c-29x5
Unknown
2 months ago
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
0.1 - 3.14.2 PYSEC-2026-3545
0.1 - 3.14.2 PYSEC-2026-3545
Impacted packages
Timeline
Published
7 hours ago
October 20, 2026 at 07:52 PM UTC
Fixed (3.14.4)
15 days ago
October 05, 2026 at 05:38 PM UTC
Last Modified
7 hours ago
October 20, 2026 at 08:00 PM UTC