{"id":"CVE-2024-52304","published":"2024-11-18T20:12:48Z","modified":"2025-11-03T20:45:25Z","title":"aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions","vendor":"aio-libs","product":"aiohttp","tier":"tail","description":{"text":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00563,"percentile":0.46823,"provenance":"source"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html","tags":[]}],"priority":{"score":13.8,"factors":[{"name":"EPSS percentile","points":9.36},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"aio-libs","affectedVersions":[{"vendor":"aio-libs","product":"aiohttp","versions":["< 3.10.11"]}],"affected":[{"ecosystem":"PyPI","package":"aiohttp","vulnerableRanges":["<3.10.11"],"patched":["3.10.11"],"from":["GHSA-8495-4g3g-x7pr","PYSEC-2026-1103"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3218","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-aio-libs-aiohttp-cve-2023-47627","parents":[{"from":"CVE-2023-47627","to":"CVE-2024-52304","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["aiohttp/http_parser.py"],"commits":["https://github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d","https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71"],"basis":"shared function","functions":["feed_data"]}]},{"from":"CVE-2024-23829","to":"CVE-2024-52304","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["aiohttp/http_parser.py"],"commits":["https://github.com/aio-libs/aiohttp/commit/33ccdfb0a12690af5bb49bda2319ec0907fa7827","https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71"],"basis":"shared function","functions":["feed_data"]}]}],"children":[{"from":"CVE-2024-52304","to":"CVE-2025-53643","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["aiohttp/http_parser.py"],"commits":["https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71","https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a"],"basis":"shared function","functions":["feed_data"]},{"kind":"similar","provenance":"machine","score":0.78,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2024-30251","published":"2024-05-02","fixed":"3.9.4","kev":false},{"cve":"CVE-2024-42367","published":"2024-08-09","fixed":"3.10.2","kev":false,"link":{"from":"CVE-2024-42367","to":"CVE-2024-52304","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:aiohttp","fromFixed":"3.10.2","toFixed":"3.10.11","daysApart":101}]}},{"cve":"CVE-2024-52303","published":"2024-11-18","fixed":"3.10.11","kev":false},{"cve":"CVE-2024-52304","published":"2024-11-18","fixed":"3.10.11","kev":false},{"cve":"CVE-2025-53643","published":"2025-07-14","fixed":"3.12.14","kev":false},{"cve":"CVE-2025-69223","published":"2026-01-05","fixed":"3.13.3","kev":false},{"cve":"CVE-2025-69224","published":"2026-01-05","fixed":"3.13.3","kev":false}],"package":"PyPI:aiohttp"}}