CVE-2023-49081: aiohttp's ClientSession is vulnerable to CRLF injection via version
Vulnerability summary
CVE-2023-49081 is a high (CVSS 7.2) Improper Input Validation vulnerability in aio-libs aiohttp. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 59.2% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 5Timeline
- 30-11-2023PublishedVulnerability first disclosed.
- 23-06-2026Last modifiedVulnerability information updated.
Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.88%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.88% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundAiohttp
Maturity: poc
184Afb593D9C2114D77F508E0Ccd508E
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse6 products
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP1< 3.6.0-150100.3.15.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP2< 3.6.0-150100.3.15.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP3< 3.6.0-150100.3.15.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 3.6.0-150100.3.15.1
- python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP5< 3.6.0-150100.3.15.1
Chainguard2 products
- py3-cassandra-medusa< 0.19.1-r1
- py3-cassandra-medusa-compat< 0.19.1-r1
Wolfi2 products
- py3-cassandra-medusa< 0.19.1-r1
- py3-cassandra-medusa-compat< 0.19.1-r1
Aio-libs1 product
- aiohttp< 3.9.0
Aiohttp1 product
- aiohttp< 3.9.0
Debian1 product
- python-aiohttp< 3.8.4-1+deb12u1 | < 3.9.1-1
Opensuse1 product
- python-aiohttp&distro=openSUSE Leap 15.5< 3.8.5-150400.10.8.1 | < 3.6.0-150100.3.15.1
PyPI1 product
- aiohttp< 1e86b777e61cf4eefc7d92fa57fa19dcc676013b | < 3.9.0
Ubuntu1 product
- python-aiohttp< 3.0.1-1ubuntu0.1~esm5 | < 3.8.1-4ubuntu0.2+esm1
9 vendors · 16 products
References
21 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2X Refsource CONFIRMWEBAdvisoryREPORTExploitVendor Advisory
- gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508eX Refsource MISCWEBREPORTExploitThird Party Advisory
Show all 21 references
- github.com/aio-libs/aiohttpPACKAGE