VulnerableCode Package Details - pkg:deb/debian/python-aiohttp@3.9.5-1?distro=trixie

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-36wp-z5r9-d3eh	aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests An attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests.	CVE-2024-30251 GHSA-5m98-qgg9-wh84
VCID-48db-pv6y-3bb3	aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.	CVE-2024-23334 GHSA-5h86-8mv2-jq9f PYSEC-2024-24
VCID-4kzt-jurh-4udw	aiohttp Cross-site Scripting vulnerability on index pages for static file handling A XSS vulnerability exists on index pages for static file handling.	CVE-2024-27306 GHSA-7gpw-8wmc-pm8g
VCID-cu3k-ug29-93hr	aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input. Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.	CVE-2024-23829 GHSA-8qpw-xqxj-h4r2 PYSEC-2024-26

Vulnerability

Summary

Aliases

VCID-36wp-z5r9-d3eh

aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests An attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests.

CVE-2024-30251
GHSA-5m98-qgg9-wh84

VCID-48db-pv6y-3bb3

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.

CVE-2024-23334
GHSA-5h86-8mv2-jq9f
PYSEC-2024-24

VCID-4kzt-jurh-4udw

aiohttp Cross-site Scripting vulnerability on index pages for static file handling A XSS vulnerability exists on index pages for static file handling.

CVE-2024-27306
GHSA-7gpw-8wmc-pm8g

VCID-cu3k-ug29-93hr

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input. Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.

CVE-2024-23829
GHSA-8qpw-xqxj-h4r2
PYSEC-2024-26

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T17:08:08.316507+00:00	Debian Importer	Fixing	VCID-36wp-z5r9-d3eh	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-06-04T17:08:08.250129+00:00	Debian Importer	Fixing	VCID-4kzt-jurh-4udw	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-06-04T17:08:08.181760+00:00	Debian Importer	Fixing	VCID-cu3k-ug29-93hr	https://security-tracker.debian.org/tracker/data/json	38.6.0
2026-06-04T17:08:08.116916+00:00	Debian Importer	Fixing	VCID-48db-pv6y-3bb3	https://security-tracker.debian.org/tracker/data/json	38.6.0