CVE-2023-47627: Request smuggling in aiohttp
Vulnerability summary
CVE-2023-47627 is a high (CVSS 7.5) vulnerability in aio-libs aiohttp. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 58.4% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 5Timeline
- 14-11-2023PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.
CVSS metrics
7 scores · 7 sources · 1 version- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.86%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.86% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundAiohttp
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard2 products
- py3-cassandra-medusa< 0.19.1-r1
- py3-cassandra-medusa-compat< 0.19.1-r1
Wolfi2 products
- py3-cassandra-medusa< 0.19.1-r1
- py3-cassandra-medusa-compat< 0.19.1-r1
Aio-libs1 product
- aiohttp< 3.8.6
Aiohttp1 product
- aiohttp< 3.8.6
Debian1 product
- python-aiohttp< 3.8.4-1+deb12u1 | < 3.8.6-1
Opensuse1 product
- python-aiohttp&distro=openSUSE Tumbleweed< 3.9.0-1.1
PyPI1 product
- aiohttp< d5c12ba890557a575c313bb3017910d7616fce3d | < 3.8.6
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded) | < 3.8.1-4ubuntu0.2+esm1
8 vendors · 10 products
References
19 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfgX Refsource CONFIRMWEBAdvisoryREPORTExploitVendor Advisory
- github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3dX Refsource MISCWEBFIXREPORTPatch
- github.com/aio-libs/aiohttpPACKAGE