The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-aiohttp | Jan 13, 2026 | Jan 5, 2026 |
| Debian | — | Upgrade python-aiohttp | Jun 2, 2026 | Jun 2, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 9.4.9 | Jul 30, 2026 | Jan 5, 2026 |
| Ubuntu | — | Upgrade python3-aiohttp (Ubuntu Pro)Upgrade python3-aiohttp | Feb 17, 2026 | Jan 5, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub