AIOHTTP vulnerabilities

AIOHTTP, an asynchronous HTTP client/server framework for Python, prior to version 3.14.3, has an out-of-bounds heap read vulnerability in the C response parser. While building an error message for a malformed response, an out-of-bounds read can occur, leading to DoS in the client. Fixed in version 3.14.3.

AIOHTTP prior to version 3.14.2 contains a request smuggling vulnerability related to WebSocket upgrades. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data.

AIOHTTP before 3.14.2 in the WebSocket client accepts and decompresses frames with the RSV1 bit set even without negotiating the permessage-deflate extension. A malicious server can cause unexpected CPU and memory consumption.

In the AIOHTTP library before version 3.14.1, a vulnerability allows bypassing the max_line_size check in HTTP requests when using the optimized C parser. An attacker can send oversized lines, causing excessive memory consumption and potentially leading to a DoS attack.

In AIOHTTP before version 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. The attack requires an open redirect vulnerability on the target domain, and the attacker only receives the digest, allowing credential extraction only if cryptography is weak or passwords are reused.

In AIOHTTP prior to version 3.14.0, cookies set via the `cookies` parameter are sent after a cross-origin redirect. If a developer uses the `cookies` parameter per-request, sensitive data might leak to an attacker controlling the redirect.

AIOHTTP, an asynchronous HTTP framework for Python, prior to version 3.14.0 has a vulnerability in the CookieJar.load() function that allows arbitrary code execution when using untrusted input. Most applications use this function with their own data, so the risk is low, but if attacker-controlled files are loaded, remote code execution may occur.

AIOHTTP versions 3.13.2 and below have a vulnerability where reading multiple invalid cookies can cause a logging storm. An attacker can craft a Cookie header to trigger excessive warning logs if the cookies attribute is accessed.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.

AIOHTTP, an asynchronous HTTP framework for asyncio and Python, versions 3.13.2 and below allow a crafted request to cause uncontrolled memory consumption on the server. If an application uses the Request.post() method in a handler, an attacker may freeze the server by exhausting memory. This issue is fixed in version 3.13.3.

AIOHTTP versions 3.13.2 and below contain a vulnerability that allows an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1) and the application includes a handler using Request.post(), an attacker may execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production), an attacker may ascertain the existence of path components. This is fixed in version 3.13.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.

A vulnerability in AIOHTTP versions 3.13.2 and below allows a zip bomb attack that, upon decompression, can exhaust host memory and cause a DoS.

The vulnerability in aiohttp allows an attacker to modify an HTTP request or create a new one if they control the HTTP version. This issue only occurs if the attacker can control the HTTP version of the request.

The vulnerability in aiohttp allows an attacker to modify the HTTP request through improper validation, potentially leading to header injection or the creation of new requests if the attacker controls the HTTP method.

A vulnerability in aiohttp (up to version 3.8.4) allows HTTP request smuggling attacks due to misinterpretation of HTTP header values. This affects users running aiohttp as an HTTP server.