CVE-2023-49081highCWE-20

CVE-2023-49081: high-severity vulnerability in aio-libs aiohttp

aiohttp's ClientSession is vulnerable to CRLF injection via version

Published · Updated

Follow this CVE+ Monitor aiohttp+ Monitor aiohttp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.9%
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
aio-libs · aiohttp
Related CVEs — aio-libs aiohttp

In the same product, most dangerous first.

CVE-2024-23334MEDIUMaiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversalEPSS 76.9%CVE-2021-21330LOWOpen redirect vulnerability in aiohttpEPSS 1.9%CVE-2023-37276MEDIUMaiohttp vulnerable to HTTP request smugglingEPSS 1.3%CVE-2024-30251HIGHDenial of service when trying to parse malformed POST requests in aiohttpEPSS 1.1%CVE-2024-23829MEDIUMaiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separatorsEPSS 1.0%CVE-2023-49082MEDIUMaiohttp's ClientSession is vulnerable to CRLF injection via methodEPSS 0.9%