{"schema_version":1,"title":"Aio-Libs vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 29 vulnerabilities in Aio-Libs: 1 in the last 7 days and 10 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123817, was published on 9 November 2026. 8 vulnerabilities in the last four weeks, up 700% on the four before (1). 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/aio-libs","json_url":"https://junglewise.ai/threats/vendors/aio-libs.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/aio-libs","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":5,"all_time":29,"critical":1,"exploited":0,"last_7_days":1,"last_30_days":9,"last_90_days":10,"last_365_days":29},"latest":[{"cve":"CVE-2026-123817","epss":0.0033,"slug":"cve-2026-123817-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"AIOHTTP WebSocket memory exhaustion via fragmented frames","severity":"info","exploited":false,"published_at":"2026-11-09T22:18:38.273+00:00","url":"https://junglewise.ai/threats/cve-2026-123817-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111750","cvss":4,"epss":0.003,"slug":"cve-2026-111750-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp HTTP request smuggling in pure Python parser","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:04.253+00:00","url":"https://junglewise.ai/threats/cve-2026-111750-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111749","cvss":4,"epss":0.0029,"slug":"cve-2026-111749-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp host-only cookie scope bypass in subdomain handling","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:04.023+00:00","url":"https://junglewise.ai/threats/cve-2026-111749-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111748","cvss":4,"epss":0.0037,"slug":"cve-2026-111748-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp Request scheme manipulation in absolute-form requests","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:03.877+00:00","url":"https://junglewise.ai/threats/cve-2026-111748-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111066","cvss":4,"epss":0.0038,"slug":"cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"AIOHTTP multipart request file descriptor exhaustion","severity":"high","exploited":false,"published_at":"2026-10-19T17:17:03.637+00:00","url":"https://junglewise.ai/threats/cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111065","cvss":4,"epss":0.0037,"slug":"cve-2026-111065-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp cookie Max-Age integer overflow causes connection pool exhaustion","severity":"medium","exploited":false,"published_at":"2026-10-19T17:17:03.503+00:00","url":"https://junglewise.ai/threats/cve-2026-111065-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111064","cvss":4,"epss":0.004,"slug":"cve-2026-111064-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp keepalive timeout enforcement bypass","severity":"high","exploited":false,"published_at":"2026-10-19T17:17:03.377+00:00","url":"https://junglewise.ai/threats/cve-2026-111064-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111063","epss":0.0022,"slug":"cve-2026-111063-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"AIOHTTP secure cookie enforcement bypass","severity":"low","exploited":false,"published_at":"2026-10-19T17:17:03.237+00:00","url":"https://junglewise.ai/threats/cve-2026-111063-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cvss":4,"slug":"aiohttp-multiple-instances-of-excessive-or-unbounded-memory-cpu-use-a4cd3374","title":"aiohttp resource exhaustion via unbounded memory/CPU use","severity":"high","exploited":false,"published_at":"2026-10-19T17:07:23+00:00","url":"https://junglewise.ai/threats/aiohttp-multiple-instances-of-excessive-or-unbounded-memory-cpu-use-a4cd3374"},{"cve":"CVE-2026-104874","cvss":5.3,"epss":0.003,"slug":"cve-2026-104874-multidict-is-an-implementation-of-a-multidict-data-structure","title":"multidict reference leak in items-view union and subtraction","severity":"medium","exploited":false,"published_at":"2026-10-02T21:16:54.993+00:00","url":"https://junglewise.ai/threats/cve-2026-104874-multidict-is-an-implementation-of-a-multidict-data-structure"},{"cve":"CVE-2026-69244","cvss":4,"epss":0.0053,"slug":"cve-2026-69244-aiohttp-out-of-bounds-heap-read-in-c-http-response-parser","title":"AIOHTTP out-of-bounds heap read in C HTTP response parser","severity":"high","exploited":false,"published_at":"2026-08-03T20:51:13+00:00","url":"https://junglewise.ai/threats/cve-2026-69244-aiohttp-out-of-bounds-heap-read-in-c-http-response-parser"},{"cve":"CVE-2026-69243","cvss":4,"epss":0.0044,"slug":"cve-2026-69243-aiohttp-request-smuggling-in-websocket-upgrade","title":"AIOHTTP request smuggling in WebSocket upgrade","severity":"medium","exploited":false,"published_at":"2026-08-03T20:46:10+00:00","url":"https://junglewise.ai/threats/cve-2026-69243-aiohttp-request-smuggling-in-websocket-upgrade"},{"cve":"CVE-2026-59881","cvss":4,"epss":0.0052,"slug":"cve-2026-59881-aio-libs-aiohttp-resource-exhaustion-in-websocket-client","title":"aio-libs aiohttp resource exhaustion in WebSocket client decompression","severity":"medium","exploited":false,"published_at":"2026-07-30T19:18:33.597+00:00","url":"https://junglewise.ai/threats/cve-2026-59881-aio-libs-aiohttp-resource-exhaustion-in-websocket-client"},{"cve":"CVE-2024-52303","cvss":3.1,"epss":0.0059,"slug":"cve-2024-52303-aiohttp-memory-leak-in-middleware-with-non-allowed-http-methods","title":"PYSEC-2026-1096 - aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method","severity":"low","exploited":false,"published_at":"2026-07-07T14:34:45.010533+00:00","url":"https://junglewise.ai/threats/cve-2024-52303-aiohttp-memory-leak-in-middleware-with-non-allowed-http-methods"},{"cve":"CVE-2026-54280","cvss":4,"epss":0.0046,"slug":"cve-2026-54280-aiohttp-improper-resource-shutdown-in-payload-handling","title":"AIOHTTP improper resource shutdown in payload handling","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:46.67+00:00","url":"https://junglewise.ai/threats/cve-2026-54280-aiohttp-improper-resource-shutdown-in-payload-handling"},{"cve":"CVE-2026-54279","cvss":4,"epss":0.0049,"slug":"cve-2026-54279-aio-libs-aiohttp-host-only-cookie-scope-loss-in-cookiejar","title":"aio-libs aiohttp host-only cookie scope loss in CookieJar","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:46.527+00:00","url":"https://junglewise.ai/threats/cve-2026-54279-aio-libs-aiohttp-host-only-cookie-scope-loss-in-cookiejar"},{"cve":"CVE-2026-54278","cvss":4,"epss":0.0049,"slug":"cve-2026-54278-aio-libs-aiohttp-denial-of-service-via-compressed-request-body","title":"aio-libs aiohttp Denial of Service via compressed request body decompression","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:46.393+00:00","url":"https://junglewise.ai/threats/cve-2026-54278-aio-libs-aiohttp-denial-of-service-via-compressed-request-body"},{"cve":"CVE-2026-54277","cvss":4,"epss":0.0056,"slug":"cve-2026-54277-aio-libs-aiohttp-denial-of-service-via-max-line-size-bypass-in-c","title":"aio-libs aiohttp denial of service via max_line_size bypass in C parser","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:46.263+00:00","url":"https://junglewise.ai/threats/cve-2026-54277-aio-libs-aiohttp-denial-of-service-via-max-line-size-bypass-in-c"},{"cve":"CVE-2026-54276","cvss":4,"epss":0.0031,"slug":"cve-2026-54276-aiohttp-information-exposure-in-digestauthmiddleware-cross-origin","title":"AIOHTTP information exposure in DigestAuthMiddleware cross-origin redirects","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:46.133+00:00","url":"https://junglewise.ai/threats/cve-2026-54276-aiohttp-information-exposure-in-digestauthmiddleware-cross-origin"},{"cve":"CVE-2026-54275","cvss":4,"epss":0.0047,"slug":"cve-2026-54275-aio-libs-aiohttp-tls-sni-check-bypass-during-connection-reuse","title":"aio-libs aiohttp TLS SNI check bypass during connection reuse","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:46.01+00:00","url":"https://junglewise.ai/threats/cve-2026-54275-aio-libs-aiohttp-tls-sni-check-bypass-during-connection-reuse"},{"cve":"CVE-2026-54274","cvss":4,"epss":0.0054,"slug":"cve-2026-54274-aio-libs-aiohttp-memory-exhaustion-in-websocket-handler","title":"aio-libs aiohttp memory exhaustion in WebSocket handler","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:45.877+00:00","url":"https://junglewise.ai/threats/cve-2026-54274-aio-libs-aiohttp-memory-exhaustion-in-websocket-handler"},{"cve":"CVE-2026-54273","cvss":4,"epss":0.0049,"slug":"cve-2026-54273-aio-libs-aiohttp-denial-of-service-via-unbounded-request","title":"aio-libs aiohttp Denial of Service via unbounded request pipelining","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:45.743+00:00","url":"https://junglewise.ai/threats/cve-2026-54273-aio-libs-aiohttp-denial-of-service-via-unbounded-request"},{"cve":"CVE-2026-50269","cvss":4,"epss":0.0053,"slug":"cve-2026-50269-aio-libs-aiohttp-crlf-injection-in-multipart-headers","title":"aio-libs aiohttp CRLF injection in multipart headers","severity":"medium","exploited":false,"published_at":"2026-06-22T18:16:42.92+00:00","url":"https://junglewise.ai/threats/cve-2026-50269-aio-libs-aiohttp-crlf-injection-in-multipart-headers"},{"cve":"CVE-2026-47265","cvss":4,"epss":0.0021,"slug":"cve-2026-47265-aiohttp-sensitive-cookie-leak-during-cross-origin-redirect","title":"AIOHTTP sensitive cookie leak during cross-origin redirect","severity":"medium","exploited":false,"published_at":"2026-06-02T20:16:37.903+00:00","url":"https://junglewise.ai/threats/cve-2026-47265-aiohttp-sensitive-cookie-leak-during-cross-origin-redirect"},{"cve":"CVE-2026-34993","cvss":6.4,"epss":0.005,"slug":"cve-2026-34993-aio-libs-aiohttp-code-execution-via-deserialization-in-cookiejar","title":"aio-libs aiohttp code execution via deserialization in CookieJar.load","severity":"medium","exploited":false,"published_at":"2026-06-02T20:16:34.857+00:00","url":"https://junglewise.ai/threats/cve-2026-34993-aio-libs-aiohttp-code-execution-via-deserialization-in-cookiejar"}],"vendor":{"hub":true,"name":"Aio-Libs","slug":"aio-libs","description":"Organization that develops asynchronous I/O libraries for Python.","url":"https://junglewise.ai/threats/vendors/aio-libs"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":8},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":1}],"most_severe":[{"cve":"CVE-2026-34520","cvss":9.1,"epss":0.0046,"slug":"cve-2026-34520-aio-libs-aiohttp-header-injection-in-llhttp-c-parser","title":"aio-libs aiohttp header injection in llhttp C parser","severity":"critical","exploited":false,"published_at":"2026-04-01T21:17:00.333+00:00","url":"https://junglewise.ai/threats/cve-2026-34520-aio-libs-aiohttp-header-injection-in-llhttp-c-parser"},{"cve":"CVE-2025-69223","cvss":7.5,"epss":0.0057,"slug":"cve-2025-69223-aio-libs-aiohttp-denial-of-service-via-zip-bomb-in-http-parser","title":"aio-libs aiohttp denial of service via zip bomb in HTTP parser","severity":"high","exploited":false,"published_at":"2026-01-05T22:15:53.017+00:00","url":"https://junglewise.ai/threats/cve-2025-69223-aio-libs-aiohttp-denial-of-service-via-zip-bomb-in-http-parser"},{"cve":"CVE-2026-69244","cvss":4,"epss":0.0053,"slug":"cve-2026-69244-aiohttp-out-of-bounds-heap-read-in-c-http-response-parser","title":"AIOHTTP out-of-bounds heap read in C HTTP response parser","severity":"high","exploited":false,"published_at":"2026-08-03T20:51:13+00:00","url":"https://junglewise.ai/threats/cve-2026-69244-aiohttp-out-of-bounds-heap-read-in-c-http-response-parser"},{"cve":"CVE-2026-111064","cvss":4,"epss":0.004,"slug":"cve-2026-111064-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"aiohttp keepalive timeout enforcement bypass","severity":"high","exploited":false,"published_at":"2026-10-19T17:17:03.377+00:00","url":"https://junglewise.ai/threats/cve-2026-111064-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cve":"CVE-2026-111066","cvss":4,"epss":0.0038,"slug":"cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for","title":"AIOHTTP multipart request file descriptor exhaustion","severity":"high","exploited":false,"published_at":"2026-10-19T17:17:03.637+00:00","url":"https://junglewise.ai/threats/cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for"},{"cvss":4,"slug":"aiohttp-multiple-instances-of-excessive-or-unbounded-memory-cpu-use-a4cd3374","title":"aiohttp resource exhaustion via unbounded memory/CPU use","severity":"high","exploited":false,"published_at":"2026-10-19T17:07:23+00:00","url":"https://junglewise.ai/threats/aiohttp-multiple-instances-of-excessive-or-unbounded-memory-cpu-use-a4cd3374"},{"cve":"CVE-2026-34993","cvss":6.4,"epss":0.005,"slug":"cve-2026-34993-aio-libs-aiohttp-code-execution-via-deserialization-in-cookiejar","title":"aio-libs aiohttp code execution via deserialization in CookieJar.load","severity":"medium","exploited":false,"published_at":"2026-06-02T20:16:34.857+00:00","url":"https://junglewise.ai/threats/cve-2026-34993-aio-libs-aiohttp-code-execution-via-deserialization-in-cookiejar"},{"cve":"CVE-2025-69230","cvss":5.3,"epss":0.0037,"slug":"cve-2025-69230-aiohttp-logging-storm-in-cookie-parsing","title":"aiohttp logging storm in cookie parsing","severity":"medium","exploited":false,"published_at":"2026-01-06T00:15:48.483+00:00","url":"https://junglewise.ai/threats/cve-2025-69230-aiohttp-logging-storm-in-cookie-parsing"},{"cve":"CVE-2026-34514","cvss":5.3,"epss":0.0032,"slug":"cve-2026-34514-aiohttp-crlf-injection-in-multipart-content-type-header","title":"aiohttp CRLF injection in multipart content type header","severity":"medium","exploited":false,"published_at":"2026-04-01T21:16:59.417+00:00","url":"https://junglewise.ai/threats/cve-2026-34514-aiohttp-crlf-injection-in-multipart-content-type-header"},{"cve":"CVE-2026-104874","cvss":5.3,"epss":0.003,"slug":"cve-2026-104874-multidict-is-an-implementation-of-a-multidict-data-structure","title":"multidict reference leak in items-view union and subtraction","severity":"medium","exploited":false,"published_at":"2026-10-02T21:16:54.993+00:00","url":"https://junglewise.ai/threats/cve-2026-104874-multidict-is-an-implementation-of-a-multidict-data-structure"}],"generated_at":"2026-11-13T03:07:00.155039+00:00","technologies":[{"name":"Aio-Libs Aiohttp","slug":"aio-libs-aiohttp","vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/aio-libs-aiohttp"}]}