AIOHTTP: File descriptor exhaustion in multipart requests

aiohttp server lacks an initial request/header timeout

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

AIOHTTP: Incomplete websocket frame payloads bypass memory limits

AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

AIOHTTP: CRLF injection in multipart headers

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

AIOHTTP: Multipart Header Size Bypass

AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

AIOHTTP vulnerable to denial of service through large payloads

AIOHTTP vulnerable to DoS when bypassing asserts

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method

Denial of service when trying to parse malformed POST requests in aiohttp

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

Request smuggling in aiohttp

aiohttp vulnerable to HTTP request smuggling

AIOHTTP Vulnerable to Deserialization of Untrusted Data

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)