DISPUTED AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, and many common contexts have exception handing in the calling application.

aio-libs aiohttp-session contains a Session Fixation vulnerability in loadsession function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttpsession/redisstorage.py#L42) that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).