Is aiohttp safe ? 55 known vulnerabilities, worst severity HIGH.
// reach 14 direct dependencies
3 carry known advisories, worst CRITICAL
868 packages depend on it
an advisory here reaches each of them
// ai model usage No published models are known to use this package.
cvss CVSS v4.0 base score out of 10
epss chance of exploitation in 30 days, 36th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-9xw5-w5jj-pvcg, the advisory selected below
// 55 advisories GHSA-9xw5-w5jj-pvcg An attacker can exhaust file descriptors with specially crafted multipart requests. HIGH GHSA-5wr8-gcqf-gqf3 The keepalive timeout was not used during the initial portion of a request. HIGH GHSA-2g87-pp6c-29x5 Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests. HIGH GHSA-cq5v-8q36-5273 An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. HIGH GHSA-6mq8-rvhq-8wgg A zip bomb can be used to execute a DoS against the aiohttp server. HIGH GHSA-5m98-qgg9-wh84 An attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. HIGH GHSA-5h86-8mv2-jq9f Improperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system. HIGH GHSA-6cjc-53gc-5rqm An overflow in Max-Age processing can skip closing a connection. MODE GHSA-f9xw-jh8m-3mwq An attacker sending an absolute-form request can spoof the scheme used. MODE GHSA-pqxq-w44r-73xw The pure Python parser is vulnerable to an HTTP request smuggling attack. MODE Show all 55 advisories // summary An attacker can exhaust file descriptors with specially crafted multipart requests.
// impact If a handler uses Request.post(), it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.
// cvss v4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Attack vector Network
Attack complexity Low
Attack requirements Present
Privileges required None
User interaction None
Confidentiality (vulnerable system) None
Integrity (vulnerable system) None
Availability (vulnerable system) High
Confidentiality (subsequent systems) None
Integrity (subsequent systems) None
Availability (subsequent systems) None Checked 2026-11-06 at 19:12 UTC. The most recent advisory here was published 2026-10-20. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page