CVE-2023-49081

MEDIUM EPSS 54.4%
Published Nov 30, 20232y ago · Modified Jun 23, 20261w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Nov 30, 2023 2y ago
Last Modified Jun 23, 2026 1w ago

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
54.4% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

Affected Products 1

VendorProductVersionRange
aiohttpaiohttp* <3.9.0

References 6

  • gist.github.com https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e
    ExploitThird Party Advisory
  • github.com https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b
  • github.com https://github.com/aio-libs/aiohttp/pull/7835/files
  • github.com https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2
    ExploitVendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.