REDHAT-BUG-2510831: Medium severity aiohttp aiohttp vulnerability
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using aiohttp's server-side component are exposed. The issue affects HTTP parsers prior to version 3.14.2.
What does an attacker need to send to exploit the flaw?
An attacker needs to send a WebSocket upgrade request that includes a body. The parser can switch protocols before receiving the complete body, causing trailing bytes to be processed incorrectly.
Are aiohttp client-only users affected?
The provided information identifies the server-side component as affected. It does not indicate exposure for client-only use.
What is the available remediation?
Upgrade aiohttp to version 3.14.2, which fixes the issue.