GHSA-pqxq-w44r-73xw: Pip/aiohttp vulnerability
Summary
The pure Python parser is vulnerable to an HTTP request smuggling attack.
Impact
If users are using the Python parser (AIOHTTPNOEXTENSIONS, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack.
Workaround
Switch to the default C parser.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4 - Configuration
Switch from the pure Python parser to the default C parser by disabling or unsetting AIOHTTP_NO_EXTENSIONS.
aiohttp AIOHTTP_NO_EXTENSIONS = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using aiohttp's pure Python parser may be exposed. This includes deployments with AIOHTTP_NO_EXTENSIONS set or deployments where a standard wheel is not installed.
What can be done if an update cannot be applied immediately?
Switch to the default C parser. The provided workaround specifically avoids use of the vulnerable pure Python parser.