CVE-2023-49082
aiohttp's ClientSession is vulnerable to CRLF injection via method
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVDNVD · Modified | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.95% · top 39% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- PyPIaiohttpGHSA-qvrw-v9rv-5rjx (opens in a new tab)
References (6)
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-qvrw-v9rv-5rjx (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/aio-libs/aiohttp/pull/7806/files (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/aio-libs/aiohttp/commit/e4ae01c2077d2cfa116aa82e4ff6866857f7c466 (opens in a new tab)x_refsource_MISCx_transferred
- https://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b (opens in a new tab)x_refsource_MISCx_transferred
- https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html (opens in a new tab)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A/ (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-qvrw-v9rv-5rjx (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-49082)Record last updated .