Most recent entries from all

CVE-2023-47627 — Request smuggling in aiohttp

2026-09-28T16:33:42.845875+00:00

Affected: aio-libs aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.

GHSA-gfw2-4jvh-wgfg — AIOHTTP has problems in HTTP parser (the python one, not llhttp)

2026-09-28T16:33:42.845982+00:00

Affected: PyPI: aiohttp

# Summary The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when `AIOHTTP_NO_EXTENSIONS` is enabled (or not using a prebuilt wheel). # Details

## Bug 1: Bad parsing of `Content-Length` values

### Description RFC 9110 says this: > `Content-Length = 1*DIGIT`

AIOHTTP does not enforce this rule, presumably because of an incorrect usage of the builtin `int` constructor. Because the `int` constructor accepts `+` and `-` prefixes, and digit-separating underscores, using `int` to parse CL values leads AIOHTTP to significant misinterpretation.

### Examples ``` GET / HTTP/1.1\r\n Content-Length: -0\r\n \r\n X ``` ``` GET / HTTP/1.1\r\n Content-Length: +0_1\r\n \r\n X ```

### Suggested action Verify that a `Content-Length` value consists only of ASCII digits before parsing, as the standard requires.

## Bug 2: Improper handling of NUL, CR, and LF in header values

### Description RFC 9110 says this: > Field values containing CR, LF, or NUL characters are invalid and dangerous, due to the varying ways that implementations might parse and interpret those characters; a recipient of CR, LF, or NUL within a field value MUST either reject the message or replace each of those characters with SP before further processing or forwarding of that message.

AIOHTTP's HTTP parser does not enforce this rule, and will happily process header values containing these three forbidden characters without replacing the…

PYSEC-2023-246

2026-09-28T16:33:42.846086+00:00

Affected: PyPI: aiohttp