aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.
References
Configurations
History
15 Aug 2025, 17:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71 - Patch | |
| References | () https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr - Vendor Advisory | |
| First Time |
Aiohttp aiohttp
Aiohttp |
|
| CPE | cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
18 Nov 2024, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-18 21:15
Updated : 2025-08-15 17:36
NVD link : CVE-2024-52304
Mitre link : CVE-2024-52304
JSON object : View
Products Affected
aiohttp
- aiohttp
CWE
No CWE.