CVE-2023-47627

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.

• CWE-444

• https://github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3dPatch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfgExploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUSJVQ7OQ55RWL4XAX2F5EZ73N4ZSH6U/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDKQ6HM3KNDU4OQI476ZWT4O7DMSIT35/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQYQL6WV535EEKSNH7KRARLLMOW5WXDM/
• https://github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3dPatch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfgExploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUSJVQ7OQ55RWL4XAX2F5EZ73N4ZSH6U/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDKQ6HM3KNDU4OQI476ZWT4O7DMSIT35/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQYQL6WV535EEKSNH7KRARLLMOW5WXDM/

Published

Nov 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47621Guest Entries is a php library which allows users to create,…8.8
• CVE-2023-47622iTop is an IT service management platform. When dashlet are…6.1
• CVE-2023-47623Scrypted is a home video integration and automation platform…6.1
• CVE-2023-47624Audiobookshelf is a self-hosted audiobook and podcast server…6.5
• CVE-2023-47625PX4 autopilot is a flight control solution for drones. In af…4.3
• CVE-2023-47626iTop is an IT service management platform. When displaying/…6.1
• CVE-2023-47628DataHub is an open-source metadata platform. DataHub Fronten…4.8
• CVE-2023-47629DataHub is an open-source metadata platform. In affected ver…8
• CVE-2023-4763Use after free in Networks in Google Chrome prior to 116.0.5…8.8
• CVE-2023-47630Kyverno is a policy engine designed for Kubernetes. An issue…7.1
• CVE-2023-47631vantage6 is a framework to manage and deploy privacy enhanci…8.8
• CVE-2023-47633Traefik is an open source HTTP reverse proxy and load balanc…7.5