{"id":"CVE-2023-47627","published":"2023-11-14T20:48:48Z","modified":"2025-11-03T20:36:06Z","title":"Request smuggling in aiohttp","vendor":"aio-libs","product":"aiohttp","tier":"tail","description":{"text":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00857,"percentile":0.58398,"provenance":"source"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDKQ6HM3KNDU4OQI476ZWT4O7DMSIT35/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQYQL6WV535EEKSNH7KRARLLMOW5WXDM/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUSJVQ7OQ55RWL4XAX2F5EZ73N4ZSH6U/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html","tags":[]}],"priority":{"score":15.4,"factors":[{"name":"EPSS percentile","points":11.68},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"aio-libs","affectedVersions":[{"vendor":"aio-libs","product":"aiohttp","versions":["< 3.8.6"]}],"affected":[{"ecosystem":"PyPI","package":"aiohttp","vulnerableRanges":["<3.8.6"],"patched":["3.8.6"],"from":["GHSA-gfw2-4jvh-wgfg","PYSEC-2023-246"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0004","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-aio-libs-aiohttp-cve-2023-47627","children":[{"from":"CVE-2023-47627","to":"CVE-2024-23829","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This vulnerability exists due to an incomplete fix for CVE-2023-47627.","from":"CVE.org","in":"CVE-2024-23829"},{"kind":"osv-related","provenance":"source","id":"GHSA-8qpw-xqxj-h4r2","via":"reference","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg"},{"kind":"same-code","provenance":"machine","files":["aiohttp/http_parser.py"],"commits":["https://github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d","https://github.com/aio-libs/aiohttp/commit/33ccdfb0a12690af5bb49bda2319ec0907fa7827"],"basis":"shared function","functions":["feed_data","get_content_length","parse_headers","parse_message"]}]},{"from":"CVE-2023-47627","to":"CVE-2024-52304","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["aiohttp/http_parser.py"],"commits":["https://github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d","https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71"],"basis":"shared function","functions":["feed_data"]}]},{"from":"CVE-2023-47627","to":"CVE-2025-53643","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["aiohttp/http_parser.py"],"commits":["https://github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d","https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a"],"basis":"shared function","functions":["feed_data","get_content_length","parse_headers","parse_message"]}]}],"packageHistory":[{"cve":"CVE-2021-21330","published":"2021-02-26","fixed":"3.7.4","kev":false},{"cve":"CVE-2023-47641","published":"2023-11-14","fixed":"3.8.0","kev":false},{"cve":"CVE-2023-37276","published":"2023-07-19","fixed":"3.8.5","kev":false,"link":{"from":"CVE-2023-37276","to":"CVE-2023-47627","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:aiohttp","fromFixed":"3.8.5","toFixed":"3.8.6","daysApart":118}]}},{"cve":"CVE-2023-47627","published":"2023-11-14","fixed":"3.8.6","kev":false},{"cve":"CVE-2023-49081","published":"2023-11-30","fixed":"3.9.0","kev":false,"link":{"from":"CVE-2023-47627","to":"CVE-2023-49081","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:aiohttp","fromFixed":"3.8.6","toFixed":"3.9.0","daysApart":16}]}},{"cve":"CVE-2023-49082","published":"2023-11-29","fixed":"3.9.0","kev":false,"link":{"from":"CVE-2023-47627","to":"CVE-2023-49082","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:aiohttp","fromFixed":"3.8.6","toFixed":"3.9.0","daysApart":15}]}},{"cve":"CVE-2024-23334","published":"2024-01-29","fixed":"3.9.2","kev":false}],"package":"PyPI:aiohttp"}}