What’s Vulnerable › Vulnerabilities

CVE-2023-49081: aiohttp's ClientSession is vulnerable to CRLF injection via version

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-11-30 · updated 2026-06-23
• Weakness: CWE-20

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

Affected products

• aio-libs aiohttp: before 3.9.0 — fixed in 3.9.0
• Pypi Aiohttp: before 3.9.0; 0.1, 0.10.0, 0.10.1, 0.10.2, 0.11.0, 0.12.0 (+218) — fixed in 3.9.0

How to fix

Upgrade to a fixed version: aio-libs aiohttp 3.9.0; Pypi Aiohttp 3.9.0. Check the vendor advisory for mitigations.

References

• https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e
• https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b
• https://github.com/aio-libs/aiohttp/pull/7835/files
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2
• https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e
• https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b
• https://github.com/aio-libs/aiohttp/pull/7835/files
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2
• https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A/

Get alerted when CVE-2023-49081 or the next vulnerability affects your stack