Medium severity · published Nov 30, 2023
CVE-2023-49081
aiohttp's ClientSession is vulnerable to CRLF injection via version
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
aiohttp · aio-libs
< 3.9.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49081
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49081
Exploit
https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e
github.com
https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b
github.com
https://github.com/aio-libs/aiohttp/pull/7835/files
Exploit
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A/
More from aiohttp
9.1
CVE-2026-34520
AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass
8.2
CVE-2026-111066
AIOHTTP: File descriptor exhaustion in multipart requests
8.2
CVE-2026-111064
aiohttp server lacks an initial request/header timeout
7.5
CVE-2026-54273
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
7.5
CVE-2026-54280
AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect