AIOHTTP's Unicode processing of header values could cause parsing discrepancies

aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp

AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

aiohttp vulnerable to XSS on index pages for static file handling

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python

AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS)

AIOHTTP: Duplicate Host header accepted

AIOHTTP: HTTP response splitting via \r in reason phrase

AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS

AIOHTTP: CRLF injection in multipart part content type header construction

AIOHTTP Vulnerable to Cookie Parser Warning Storm

AIOHTTP vulnerable to DoS through chunked messages

AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

AIOHTTP allows for a brute-force leak of internal static filepath components

aiohttp's ClientSession is vulnerable to CRLF injection via version

aiohttp's ClientSession is vulnerable to CRLF injection via method

In aiohttp, compressed files as symlinks are not protected from path traversal