# aiohttp (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/aiohttp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/aiohttp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 56 vulnerabilities in aiohttp (PyPI): 0 in the last 7 days and 8 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111750, was published on 19 October 2026. 8 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 8 - Last 90 days: 8 - All time: 56 (1 critical, 0 exploited in the wild) ## About aiohttp (PyPI) aiohttp is a Python library for building asynchronous HTTP clients and servers. ## Latest aiohttp (PyPI) vulnerabilities - [CVE-2026-111750: aiohttp HTTP request smuggling in pure Python parser](https://junglewise.ai/threats/cve-2026-111750-aiohttp-is-an-asynchronous-http-client-server-framework-for) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-111749: aiohttp host-only cookie scope bypass in subdomain handling](https://junglewise.ai/threats/cve-2026-111749-aiohttp-is-an-asynchronous-http-client-server-framework-for) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-111748: aiohttp Request scheme manipulation in absolute-form requests](https://junglewise.ai/threats/cve-2026-111748-aiohttp-is-an-asynchronous-http-client-server-framework-for) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-111066: AIOHTTP multipart request file descriptor exhaustion](https://junglewise.ai/threats/cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-111065: aiohttp cookie Max-Age integer overflow causes connection pool exhaustion](https://junglewise.ai/threats/cve-2026-111065-aiohttp-is-an-asynchronous-http-client-server-framework-for) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-111064: aiohttp keepalive timeout enforcement bypass](https://junglewise.ai/threats/cve-2026-111064-aiohttp-is-an-asynchronous-http-client-server-framework-for) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-111063: AIOHTTP secure cookie enforcement bypass](https://junglewise.ai/threats/cve-2026-111063-aiohttp-is-an-asynchronous-http-client-server-framework-for) (low, published 19 Oct 2026) - [aiohttp resource exhaustion via unbounded memory/CPU use](https://junglewise.ai/threats/aiohttp-multiple-instances-of-excessive-or-unbounded-memory-cpu-use-a4cd3374) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-69244: AIOHTTP out-of-bounds heap read in C HTTP response parser](https://junglewise.ai/threats/cve-2026-69244-aiohttp-out-of-bounds-heap-read-in-c-http-response-parser) (high, CVSS 4, published 3 Aug 2026) - [CVE-2026-69243: AIOHTTP request smuggling in WebSocket upgrade](https://junglewise.ai/threats/cve-2026-69243-aiohttp-request-smuggling-in-websocket-upgrade) (medium, CVSS 4, published 3 Aug 2026) - [CVE-2026-59881: aio-libs aiohttp resource exhaustion in WebSocket client decompression](https://junglewise.ai/threats/cve-2026-59881-aio-libs-aiohttp-resource-exhaustion-in-websocket-client) (medium, CVSS 4, published 30 Jul 2026) - [CVE-2025-53643: PYSEC-2026-1104 - AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer…](https://junglewise.ai/threats/cve-2025-53643-aiohttp-is-vulnerable-to-http-request-response-smuggling-through) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2024-52304: PYSEC-2026-1103 - aiohttp allows request smuggling due to incorrect parsing of chunk extensions](https://junglewise.ai/threats/cve-2024-52304-aiohttp-allows-request-smuggling-due-to-incorrect-parsing-of) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2024-52303: PYSEC-2026-1096 - aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method](https://junglewise.ai/threats/cve-2024-52303-aiohttp-memory-leak-in-middleware-with-non-allowed-http-methods) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-42367: PYSEC-2026-1108 - In aiohttp, compressed files as symlinks are not protected from path traversal](https://junglewise.ai/threats/cve-2024-42367-in-aiohttp-compressed-files-as-symlinks-are-not-protected-from) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-30251: PYSEC-2026-1098 - aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests](https://junglewise.ai/threats/cve-2024-30251-aiohttp-vulnerable-to-denial-of-service-when-trying-to-parse) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-27306: PYSEC-2026-1102 - aiohttp Cross-site Scripting vulnerability on index pages for static file handling](https://junglewise.ai/threats/cve-2024-27306-aiohttp-cross-site-scripting-vulnerability-on-index-pages-for) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-54280: AIOHTTP improper resource shutdown in payload handling](https://junglewise.ai/threats/cve-2026-54280-aiohttp-improper-resource-shutdown-in-payload-handling) (medium, CVSS 4, published 22 Jun 2026) - [CVE-2026-54279: aio-libs aiohttp host-only cookie scope loss in CookieJar](https://junglewise.ai/threats/cve-2026-54279-aio-libs-aiohttp-host-only-cookie-scope-loss-in-cookiejar) (medium, CVSS 4, published 22 Jun 2026) - [CVE-2026-54278: aio-libs aiohttp Denial of Service via compressed request body decompression](https://junglewise.ai/threats/cve-2026-54278-aio-libs-aiohttp-denial-of-service-via-compressed-request-body) (medium, CVSS 4, published 22 Jun 2026) - [CVE-2026-54277: aio-libs aiohttp denial of service via max_line_size bypass in C parser](https://junglewise.ai/threats/cve-2026-54277-aio-libs-aiohttp-denial-of-service-via-max-line-size-bypass-in-c) (medium, CVSS 4, published 22 Jun 2026) - [CVE-2026-54276: AIOHTTP information exposure in DigestAuthMiddleware cross-origin redirects](https://junglewise.ai/threats/cve-2026-54276-aiohttp-information-exposure-in-digestauthmiddleware-cross-origin) (medium, CVSS 4, published 22 Jun 2026) - [CVE-2026-54275: aio-libs aiohttp TLS SNI check bypass during connection reuse](https://junglewise.ai/threats/cve-2026-54275-aio-libs-aiohttp-tls-sni-check-bypass-during-connection-reuse) (medium, CVSS 4, published 22 Jun 2026) - [CVE-2026-54274: aio-libs aiohttp memory exhaustion in WebSocket handler](https://junglewise.ai/threats/cve-2026-54274-aio-libs-aiohttp-memory-exhaustion-in-websocket-handler) (medium, CVSS 4, published 22 Jun 2026) - [CVE-2026-54273: aio-libs aiohttp Denial of Service via unbounded request pipelining](https://junglewise.ai/threats/cve-2026-54273-aio-libs-aiohttp-denial-of-service-via-unbounded-request) (medium, CVSS 4, published 22 Jun 2026) ## Most severe aiohttp (PyPI) vulnerabilities - [CVE-2026-34520: aio-libs aiohttp header injection in llhttp C parser](https://junglewise.ai/threats/cve-2026-34520-aio-libs-aiohttp-header-injection-in-llhttp-c-parser) (critical, CVSS 9.1, published 1 Apr 2026) - [CVE-2025-69223: aio-libs aiohttp denial of service via zip bomb in HTTP parser](https://junglewise.ai/threats/cve-2025-69223-aio-libs-aiohttp-denial-of-service-via-zip-bomb-in-http-parser) (high, CVSS 7.5, published 5 Jan 2026) - [CVE-2026-34516: AIOHTTP has a Multipart Header Size Bypass](https://junglewise.ai/threats/cve-2026-34516-aiohttp-has-a-multipart-header-size-bypass) (high, CVSS 7.5, published 1 Apr 2026) - [CVE-2026-34513: AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector](https://junglewise.ai/threats/cve-2026-34513-aiohttp-affected-by-denial-of-service-dos-via-unbounded-dns-cache) (high, CVSS 7.5, published 1 Apr 2026) - [CVE-2026-22815: aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage](https://junglewise.ai/threats/cve-2026-22815-aiohttp-allows-unlimited-trailer-headers-leading-to-possible) (high, CVSS 7.5, published 1 Apr 2026) - [CVE-2026-34515: AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows](https://junglewise.ai/threats/cve-2026-34515-aiohttp-affected-by-unc-ssrf-ntlmv2-credential-theft-local-file) (high, CVSS 7.5, published 1 Apr 2026) - [CVE-2025-69228: PYSEC-2026-1100 - AIOHTTP vulnerable to denial of service through large payloads](https://junglewise.ai/threats/cve-2025-69228-aiohttp-vulnerable-to-denial-of-service-through-large-payloads) (high, CVSS 7.5, published 6 Jan 2026) - [CVE-2025-69227: PYSEC-2026-1107 - AIOHTTP vulnerable to DoS when bypassing asserts](https://junglewise.ai/threats/cve-2025-69227-aiohttp-vulnerable-to-dos-when-bypassing-asserts) (high, CVSS 7.5, published 6 Jan 2026) - [CVE-2026-69244: AIOHTTP out-of-bounds heap read in C HTTP response parser](https://junglewise.ai/threats/cve-2026-69244-aiohttp-out-of-bounds-heap-read-in-c-http-response-parser) (high, CVSS 4, published 3 Aug 2026) - [CVE-2026-111064: aiohttp keepalive timeout enforcement bypass](https://junglewise.ai/threats/cve-2026-111064-aiohttp-is-an-asynchronous-http-client-server-framework-for) (high, CVSS 4, published 19 Oct 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 8 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "aiohttp (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/aiohttp, 13 November 2026.