CVE-2023-37276

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`). Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling. This issue has been addressed in version 3.8.5. Users are advised to upgrade. Users unable to upgrade can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable.

• CWE-444
• CWE-444

• https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodulesProduct
• https://github.com/aio-libs/aiohttp/commit/9337fb3f2ab2b5f38d7e98a194bde6f7e3d16c40Patch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6wExploit, Mitigation, Vendor Advisory
• https://hackerone.com/reports/2001873Exploit, Third Party Advisory
• https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodulesProduct
• https://github.com/aio-libs/aiohttp/commit/9337fb3f2ab2b5f38d7e98a194bde6f7e3d16c40Patch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6wExploit, Mitigation, Vendor Advisory
• https://hackerone.com/reports/2001873Exploit, Third Party Advisory

Published

Jul 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37270Piwigo is open source photo gallery software. Prior to versi…8.8
• CVE-2023-37271RestrictedPython is a tool that helps to define a subset of …9.9
• CVE-2023-37272JS7 is an Open Source Job Scheduler. Users specify file name…5.4
• CVE-2023-37273Auto-GPT is an experimental open-source application showcasi…8.8
• CVE-2023-37274Auto-GPT is an experimental open-source application showcasi…7.8
• CVE-2023-37275Auto-GPT is an experimental open-source application showcasi…4.3
• CVE-2023-37277XWiki Platform is a generic wiki platform offering runtime s…9.6
• CVE-2023-37278GLPI is a Free Asset and IT Management Software package, Dat…9.1
• CVE-2023-37279Faktory is a language-agnostic persistent background job ser…7.5
• CVE-2023-3728Use after free in WebRTC in Google Chrome prior to 115.0.579…8.8
• CVE-2023-37280Pimcore Admin Classic Bundle provides a Backend UI for Pimco…6.1
• CVE-2023-37281Contiki-NG is an operating system for internet-of-things dev…5.3