PT-2023-7418 · Aiohttp+5 · Aiohttp+5
Jnovikov
·
Published
2023-07-19
·
Updated
2025-11-04
·
CVE-2023-49081
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
aiohttp versions prior to 3.9.0
Description
The issue arises from improper validation, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP version. This can lead to CRLF injection and Request Smuggling. The vulnerability is exploitable when the attacker can control the HTTP version of the request, including its type, and when the
Connection header is passed to the headers parameter. For example, if an unvalidated JSON value is used as a version and the attacker passes an array as the version parameter, it can bypass validation.Recommendations
For versions prior to 3.9.0, update to version 3.9.0 to resolve the issue.
As a temporary workaround, validate the user input to the
version parameter to ensure it is a str.Exploit
Fix
DoS
RCE
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Red Os
Suse
Ubuntu
Aiohttp