[ Vendor · 8 CVEs ]
aio-libs
CVEs affecting aio-libs published in the last 30 days, plus any aio-libs CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111749 | 19 Oct 2026 | CVSS 2.3 | AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie… | Fix |
| CVE-2026-111750 | 19 Oct 2026 | CVSS 6.3 | AIOHTTP: Pure-Python parser request smugglingAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP… | Fix |
| CVE-2026-111063 | 19 Oct 2026 | CVSS 6.3 | AIOHTTP: Secure attribute not enforced for shared cookieAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not… | Fix |
| CVE-2026-111064 | 19 Oct 2026 | CVSS 8.2 | aiohttp server lacks an initial request/header timeoutAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the… | Fix |
| CVE-2026-111065 | 19 Oct 2026 | CVSS 6.9 | AIOHTTP: Connector pool exhaustion via Max-Age overflowAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a… | Fix |
| CVE-2026-111066 | 19 Oct 2026 | CVSS 8.2 | AIOHTTP: File descriptor exhaustion in multipart requestsAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an… | Fix |
| CVE-2026-111748 | 19 Oct 2026 | CVSS 6.3 | AIOHTTP: Absolute-form request targets can spoof Request.schemeAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that… | Fix |
| CVE-2026-104874 | 2 Oct 2026 | CVSS 5.3 | Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionMultidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand… | Fix |