CVE-2023-49081

Advisory

Affected versions of the `aiohttp` package are vulnerable to Improper Input Validation due to insufficient checks on the HTTP version of incoming requests. The vulnerability arises because the HTTP request handling mechanism does not adequately validate the HTTP version, allowing manipulation if controlled by an attacker. An attacker with the ability to influence the HTTP version can exploit this flaw to inject new headers or craft entirely new HTTP requests, potentially leading to unauthorized actions or data exposure.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49081