Dreamsorcerer

**Name of the Vulnerable Software and Affected Versions** AIOHTTP versions prior to 3.14.0 **Description** Cookies set using the `cookies` parameter on requests are sent after following a cross-origin redirect. This behavior can lead to the leakage of sensitive data to an attacker if they can control the redirect destination. **Recommendations** Update to version 3.14.0. As a temporary workaround, use a `Cookie` header within the `headers` parameter instead of the `cookies` parameter.

**Name of the Vulnerable Software and Affected Versions** aiohttp versions 3.10.6 through 3.10.10 **Description** A memory leak can occur when a request produces a `MatchInfoError`. This issue is caused by adding an entry to a cache on each request, due to the building of each `MatchInfoError` producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. **Recommendations** For aiohttp versions 3.10.6 through 3.10.10, upgrade to version 3.10.11 to receive a patch. As a temporary workaround, consider restricting the number of requests that can produce a `MatchInfoError` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** aiohttp versions prior to 3.8.0 **Description** The issue is related to the inconsistent interpretation of the HTTP protocol, specifically when both `Content-Length` and `Transfer-Encoding` headers are present. This can lead to incorrect interpretation by entities parsing the HTTP, allowing for socket poisoning. A possible scenario involves a reverse proxy setup with aiohttp as the backend, where an attacker can bypass proxy rules, pass authentication headers, or combine with an Open Redirect to redirect users to another website. The estimated number of potentially affected devices is not specified. **Recommendations** For versions prior to 3.8.0, upgrade to release 3.8.0 or later to address the security vulnerability. As a temporary workaround, consider restricting the use of the `Transfer-Encoding` header or disabling the parsing of chunked requests until a patch is applied. Avoid using configurations that accept both `Content-Length` and `Transfer-Encoding` headers. Restrict access to sensitive areas of the application to minimize the risk of exploitation.