https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:19:11 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-10292 bdu:2024-10292 https://cve.radiocsirt.org/vuln/bdu:2024-10292 https://cve.radiocsirt.org/vuln/brew-aider-cve-2024-52304 <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.</p> <p>### Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71</p> <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.</p> <p>### Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71</p> https://cve.radiocsirt.org/vuln/brew-aider-cve-2024-52304 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0481 certfr-2025-avi-0481 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0481 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 https://cve.radiocsirt.org/vuln/euvd-2026-258199 EUVD-2026-258199 https://cve.radiocsirt.org/vuln/euvd-2026-258199 https://cve.radiocsirt.org/vuln/fkie_cve-2024-52304 <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-52304 https://cve.radiocsirt.org/vuln/ghsa-8495-4g3g-x7pr <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.</p> <p>### Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.</p> <p>### Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71</p> https://cve.radiocsirt.org/vuln/ghsa-8495-4g3g-x7pr https://cve.radiocsirt.org/vuln/oesa-2025-1045 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: python-aiohttp</p> <p>Async http client/server framework (asyncio). Security Fix(es): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.(CVE-2024-52304)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: python-aiohttp</p> <p>Async http client/server framework (asyncio). Security Fix(es): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.(CVE-2024-52304)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1045 https://cve.radiocsirt.org/vuln/pysec-2026-1103 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.</p> <p>### Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.</p> <p>### Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71</p> https://cve.radiocsirt.org/vuln/pysec-2026-1103 https://cve.radiocsirt.org/vuln/rhsa-2024:10766 <p>aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux</p> <p>aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux</p> https://cve.radiocsirt.org/vuln/rhsa-2024:10766 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-52304 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-52304 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3584 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3584