{"schema_version":1,"title":"Aio-Libs Aiohttp vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 11 vulnerabilities in Aio-Libs Aiohttp: 1 in the last 7 days and 9 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123817, was published on 9 November 2026. 8 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/aio-libs-aiohttp","json_url":"https://junglewise.ai/threats/technologies/aio-libs-aiohttp.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/aio-libs-aiohttp","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":3,"all_time":11,"critical":1,"exploited":0,"last_7_days":1,"last_30_days":9,"last_90_days":9,"last_365_days":11},"latest":[{"cve":"CVE-2026-123817","epss":0.0033,"slug":"cve-2026-123817-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"AIOHTTP WebSocket memory exhaustion via fragmented frames","severity":"info","exploited":false,"published_at":"2026-11-09T22:18:38.273+00:00","url":"https://junglewise.ai/threats/cve-2026-123817-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111750","cvss":4,"epss":0.003,"slug":"cve-2026-111750-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp HTTP request smuggling in pure Python parser","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:04.253+00:00","url":"https://junglewise.ai/threats/cve-2026-111750-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111749","cvss":4,"epss":0.0029,"slug":"cve-2026-111749-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp host-only cookie scope bypass in subdomain handling","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:04.023+00:00","url":"https://junglewise.ai/threats/cve-2026-111749-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111748","cvss":4,"epss":0.0037,"slug":"cve-2026-111748-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp Request scheme manipulation in absolute-form requests","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:03.877+00:00","url":"https://junglewise.ai/threats/cve-2026-111748-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111066","cvss":4,"epss":0.0038,"slug":"cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"AIOHTTP multipart request file descriptor exhaustion","severity":"high","exploited":false,"published_at":"2026-10-19T17:17:03.637+00:00","url":"https://junglewise.ai/threats/cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111065","cvss":4,"epss":0.0037,"slug":"cve-2026-111065-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp cookie Max-Age integer overflow causes connection pool exhaustion","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:03.503+00:00","url":"https://junglewise.ai/threats/cve-2026-111065-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111064","cvss":4,"epss":0.004,"slug":"cve-2026-111064-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp keepalive timeout enforcement bypass","severity":"high","exploited":false,"published_at":"2026-10-19T17:17:03.377+00:00","url":"https://junglewise.ai/threats/cve-2026-111064-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111063","epss":0.0022,"slug":"cve-2026-111063-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"AIOHTTP secure cookie enforcement bypass","severity":"low","exploited":false,"published_at":"2026-10-19T17:17:03.237+00:00","url":"https://junglewise.ai/threats/cve-2026-111063-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cvss":4,"slug":"aiohttp-multiple-instances-of-excessive-or-unbounded-memory-cpu-use-a4cd3374","title":"aiohttp resource exhaustion via unbounded memory/CPU use","severity":"high","exploited":false,"published_at":"2026-10-19T17:07:23+00:00","url":"https://junglewise.ai/threats/aiohttp-multiple-instances-of-excessive-or-unbounded-memory-cpu-use-a4cd3374"},{"cve":"CVE-2026-34520","cvss":9.1,"epss":0.0046,"slug":"cve-2026-34520-aio-libs-aiohttp-header-injection-in-llhttp-c-parser","title":"aio-libs aiohttp header injection in llhttp C parser","severity":"critical","exploited":false,"published_at":"2026-04-01T21:17:00.333+00:00","url":"https://junglewise.ai/threats/cve-2026-34520-aio-libs-aiohttp-header-injection-in-llhttp-c-parser"},{"cve":"CVE-2026-34514","cvss":5.3,"epss":0.0032,"slug":"cve-2026-34514-aiohttp-crlf-injection-in-multipart-content-type-header","title":"aiohttp CRLF injection in multipart content type header","severity":"medium","exploited":false,"published_at":"2026-04-01T21:16:59.417+00:00","url":"https://junglewise.ai/threats/cve-2026-34514-aiohttp-crlf-injection-in-multipart-content-type-header"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":8},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":1}],"related":[],"technology":{"hub":true,"name":"Aio-Libs Aiohttp","slug":"aio-libs-aiohttp","vendor":{"hub":true,"name":"Aio-Libs","slug":"aio-libs","url":"https://junglewise.ai/threats/vendors/aio-libs"},"aliases":[],"category":"library","description":"Python asynchronous HTTP client/server library for web applications.","url":"https://junglewise.ai/threats/technologies/aio-libs-aiohttp"},"most_severe":[{"cve":"CVE-2026-34520","cvss":9.1,"epss":0.0046,"slug":"cve-2026-34520-aio-libs-aiohttp-header-injection-in-llhttp-c-parser","title":"aio-libs aiohttp header injection in llhttp C parser","severity":"critical","exploited":false,"published_at":"2026-04-01T21:17:00.333+00:00","url":"https://junglewise.ai/threats/cve-2026-34520-aio-libs-aiohttp-header-injection-in-llhttp-c-parser"},{"cve":"CVE-2026-111064","cvss":4,"epss":0.004,"slug":"cve-2026-111064-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp keepalive timeout enforcement bypass","severity":"high","exploited":false,"published_at":"2026-10-19T17:17:03.377+00:00","url":"https://junglewise.ai/threats/cve-2026-111064-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111066","cvss":4,"epss":0.0038,"slug":"cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"AIOHTTP multipart request file descriptor exhaustion","severity":"high","exploited":false,"published_at":"2026-10-19T17:17:03.637+00:00","url":"https://junglewise.ai/threats/cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cvss":4,"slug":"aiohttp-multiple-instances-of-excessive-or-unbounded-memory-cpu-use-a4cd3374","title":"aiohttp resource exhaustion via unbounded memory/CPU use","severity":"high","exploited":false,"published_at":"2026-10-19T17:07:23+00:00","url":"https://junglewise.ai/threats/aiohttp-multiple-instances-of-excessive-or-unbounded-memory-cpu-use-a4cd3374"},{"cve":"CVE-2026-34514","cvss":5.3,"epss":0.0032,"slug":"cve-2026-34514-aiohttp-crlf-injection-in-multipart-content-type-header","title":"aiohttp CRLF injection in multipart content type header","severity":"medium","exploited":false,"published_at":"2026-04-01T21:16:59.417+00:00","url":"https://junglewise.ai/threats/cve-2026-34514-aiohttp-crlf-injection-in-multipart-content-type-header"},{"cve":"CVE-2026-111748","cvss":4,"epss":0.0037,"slug":"cve-2026-111748-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp Request scheme manipulation in absolute-form requests","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:03.877+00:00","url":"https://junglewise.ai/threats/cve-2026-111748-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111065","cvss":4,"epss":0.0037,"slug":"cve-2026-111065-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp cookie Max-Age integer overflow causes connection pool exhaustion","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:03.503+00:00","url":"https://junglewise.ai/threats/cve-2026-111065-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111750","cvss":4,"epss":0.003,"slug":"cve-2026-111750-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp HTTP request smuggling in pure Python parser","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:04.253+00:00","url":"https://junglewise.ai/threats/cve-2026-111750-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111749","cvss":4,"epss":0.0029,"slug":"cve-2026-111749-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp host-only cookie scope bypass in subdomain handling","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:04.023+00:00","url":"https://junglewise.ai/threats/cve-2026-111749-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111063","epss":0.0022,"slug":"cve-2026-111063-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"AIOHTTP secure cookie enforcement bypass","severity":"low","exploited":false,"published_at":"2026-10-19T17:17:03.237+00:00","url":"https://junglewise.ai/threats/cve-2026-111063-aiohttp-is-an-asynchronous-http-client-server-framework-for"}],"generated_at":"2026-11-12T23:07:00.176006+00:00"}