PT-2023-7245 · Aiohttp+5 · Aiohttp+5

Jnovikov · Published 2023-10-29 · Updated 2025-11-04 · CVE-2023-49082

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.9.0

Description The issue is related to improper validation in the aiohttp HTTP client/server framework, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP method. This can lead to HTTP request smuggling if the attacker can control the HTTP version of the request. The vulnerability occurs when an attacker can control the HTTP method of the request, such as GET or POST.

Recommendations For versions prior to 3.9.0, update to version 3.9.0 to resolve the issue. As a temporary workaround, consider performing manual validation of user-provided values for the request method, such as restricting it to known values like GET or POST.

Exploit

Fix

DoS

RCE

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-20

CWE-444

CWE-93

Related Identifiers

ALT-PU-2024-16702

ALT-PU-2024-6120

BDU:2023-08273

CVE-2023-49082

DLA-4041-1

DSA-5828-1

GHSA-QVRW-V9RV-5RJX

OESA-2025-1250

OESA-2025-1346

OESA-2025-1347

OPENSUSE-SU-2024_0168-1

PYSEC-2023-251

RHSA-2024:1057

RHSA-2024:1878

RHSA-2024:2010

SUSE-SU-2024:0168-1

USN-7642-1

Affected Products

Alt Linux

Linuxmint

Red Os

Suse

Ubuntu

Aiohttp

References · 54

• 🔥 https://github.com/aio-libs/aiohttp/security/advisories/GHSA-qvrw-v9rv-5rjx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49082.json · Exploit
• 🔥 https://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-30251 · Security Note
• https://ubuntu.com/security/notices/USN-7642-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5828-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-49081 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-30251 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qvrw-v9rv-5rjx · Vendor Advisory
• https://osv.dev/vulnerability/USN-7642-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08273 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-27306 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-23334 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-47627 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49082 · Vendor Advisory