aio-libs aiohttp vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20235
3. 20247
4. 20251
5. 202639

Newest CVEs

• CVE-2026-111750

  AIOHTTP: Pure-Python parser request smuggling

  aio-libs · aiohttp

  Medium6.3
• CVE-2026-111749

  AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

  aio-libs · aiohttp

  Low2.3
• CVE-2026-111748

  AIOHTTP: Absolute-form request targets can spoof Request.scheme

  aio-libs · aiohttp

  Medium6.3
• CVE-2026-111066

  AIOHTTP: File descriptor exhaustion in multipart requests

  aio-libs · aiohttp

  High8.2
• CVE-2026-111065

  AIOHTTP: Connector pool exhaustion via Max-Age overflow

  aio-libs · aiohttp

  Medium6.9
• CVE-2026-111064

  aiohttp server lacks an initial request/header timeout

  aio-libs · aiohttp

  High8.2
• CVE-2026-111063

  AIOHTTP: Secure attribute not enforced for shared cookie

  aio-libs · aiohttp

  Medium6.3
• CVE-2026-69244

  AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

  aio-libs · aiohttp

  High7.1
• CVE-2026-69243

  AIOHTTP: HTTP request smuggling via WebSocket upgrade

  aio-libs · aiohttp

  Medium6.3
• CVE-2026-59881

  AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

  aio-libs · aiohttp

  Medium6.9