Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:rpm/redhat/python-aiohttp@3.7.4-1?arch=el7pc
purl pkg:rpm/redhat/python-aiohttp@3.7.4-1?arch=el7pc
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 3.7
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-88cm-cxp9-ekgn
Aliases:
CVE-2021-21330
GHSA-v6wp-4m6f-gcjg
PYSEC-2021-76
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T14:03:05.493379+00:00 RedHat Importer Affected by VCID-88cm-cxp9-ekgn https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-21330.json 38.0.0