GitHub Advisoryadvisory · PyPI

GHSA-pjjw-qhg8-p2p9 aiohttp has vulnerable dependency that is vulnerable to request smuggling

MEDIUM Published 2023-11-27 Modified 2023-11-27 Official page ↗
Ecosystem
PyPI
Packages
aiohttp
Severity
Moderate
Weaknesses
CWE-444
Reviewed
2023-11-27

Affected packages

• PyPI aiohttp: < 3.8.6 → fixed in 3.8.6

Description

Summary llhttp 8.1.1 is vulnerable to two request smuggling vulnerabilities. Details have not been disclosed yet, so refer to llhttp for future information. The issue is resolved by using llhttp 9+ (which is included in aiohttp 3.8.6+).

Related

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References