Vulnerabilidades em aio-libs
58 resultadosAnálise Vexday
A aio-libs acumula 47 CVEs na base, sendo 11 publicadas nos últimos 90 dias, o que indica ritmo consistente de descobertas. Nenhuma vulnerabilidade está sob ataque ativo e não há críticas confirmadas, reduzindo pressão imediata, mas a fraqueza dominante (CWE-770 - alocação de recursos sem limite) sugere problemas estruturais de consumo de recursos que demandam atenção.
CVE-2024-23334MEDIUMaiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversalEPSS 76.9%CVE-2021-21330LOWOpen redirect vulnerability in aiohttpEPSS 1.9%CVE-2023-37276MEDIUMaiohttp vulnerable to HTTP request smugglingEPSS 1.3%CVE-2024-30251HIGHDenial of service when trying to parse malformed POST requests in aiohttpEPSS 1.1%CVE-2024-23829MEDIUMaiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separatorsEPSS 1.0%CVE-2023-49082MEDIUMaiohttp's ClientSession is vulnerable to CRLF injection via methodEPSS 0.9%CVE-2023-49081HIGHaiohttp's ClientSession is vulnerable to CRLF injection via versionEPSS 0.9%CVE-2023-47627MEDIUMRequest smuggling in aiohttpEPSS 0.9%CVE-2023-47641LOWInconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttpEPSS 0.8%CVE-2024-27306MEDIUMaiohttp vulnerable to XSS on index pages for static file handlingEPSS 0.7%CVE-2024-42367MEDIUMIn aiohttp, compressed files as symlinks are not protected from path traversalEPSS 0.7%CVE-2024-52303HIGHaiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed methodEPSS 0.6%CVE-2025-69223HIGHAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombEPSS 0.6%CVE-2024-52304MEDIUMaiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensionsEPSS 0.6%CVE-2026-54277MEDIUMAIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented LinesEPSS 0.6%CVE-2026-54274MEDIUMAIOHTTP: Incomplete websocket frame payloads bypass memory limitsEPSS 0.5%CVE-2026-50269LOWAIOHTTP: CRLF injection in multipart headersEPSS 0.5%CVE-2026-69244HIGHAIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)EPSS 0.5%CVE-2026-59881MEDIUMAIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflateEPSS 0.5%CVE-2026-54279LOWAIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar PersistenceEPSS 0.5%