aiohttp's ClientSession is vulnerable to CRLF injection via version (aio-libs aiohttp)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.88 % · percentile 59 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
Weaknesses (CWE)
- CWE-20 — Improper Input Validation
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2
- https://github.com/aio-libs/aiohttp/pull/7835/files
- https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b
- https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e
- https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N | GitHub_M |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-q3qx-c6g2-7pw2 — aiohttp's ClientSession is vulnerable to CRLF injection via version
- PYSEC-2023-250 — aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request
European references
- ENISA EUVD · EUVD-2023-0006
- GCVE · GCVE-0-2023-49081
CERT-FR advisories
- CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0145 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*< 3.9.0
Affected products
| Product | Versions |
|---|---|
| aio-libs · aiohttp | affected < 3.9.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |