aiohttp
PyPI54 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting aiohttppage 2 of 2
- CVE-2026-54280HIGHCVSS 7.5EG 7.5fixed in 3.14.12026-06-15
vulnerable: 0.1 ... 3.9.5 (307 versions)
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar l…
- CVE-2026-59881MEDIUMCVSS 6.9EG 6.9fixed in 3.14.22026-07-30
vulnerable: 0.1 ... 3.9.5 (308 versions)
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allo…
- CVE-2026-69243MEDIUMCVSS 6.3EG 6.3fixed in 3.14.22026-08-03
vulnerable: 0.1 ... 3.9.5 (308 versions)
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker…
- CVE-2026-69244HIGHCVSS 7.1EG 7.1fixed in 3.14.32026-08-03
vulnerable: 0.1 ... 3.9.5 (309 versions)
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controll…
Check whether aiohttp is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for aiohttp CVEs against the assets you own.
Book a Demo →