aio-libs/aiohttp · Security
aiohttp has vulnerable dependency that is vulnerable to request smuggling
- GHSA ID
- GHSA-pjjw-qhg8-p2p9
- Severity
- medium
- Published
- Updated
Description
Summary
llhttp 8.1.1 is vulnerable to two request smuggling vulnerabilities. Details have not been disclosed yet, so refer to llhttp for future information. The issue is resolved by using llhttp 9+ (which is included in aiohttp 3.8.6+).
CWEs
- CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')