GHSA-pjjw-qhg8-p2p9: Pip/aiohttp vulnerability
Published Nov 27, 2023
·Updated
Summary llhttp 8.1.1 is vulnerable to two request smuggling vulnerabilities. Details have not been disclosed yet, so refer to llhttp for future information. The issue is resolved by using llhttp 9+ (which is included in aiohttp 3.8.6+).
Affected Software
1 affected componentFixes available
pip/aiohttp<3.8.6
3.8.6
Event History
Nov 27, 2023
Advisory Published
11:15 PM
Frequently Asked Questions
1
What is the vulnerability ID for llhttp 8.1.1?
The vulnerability ID for llhttp 8.1.1 is GHSA-pjjw-qhg8-p2p9.
2
What are the affected software versions?
Versions up to exclusive of aiohttp 3.8.6 are affected.
3
How can I fix the vulnerability?
The issue can be resolved by using aiohttp 3.8.6 or later, which includes llhttp 9+.
4
What is the severity of GHSA-pjjw-qhg8-p2p9?
The severity of GHSA-pjjw-qhg8-p2p9 has not been disclosed yet.
5
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The CWE ID for this vulnerability is 444.