aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-aiohttp | Feb 5, 2025 | Apr 18, 2024 |
| Suse | — | Upgrade python-aiohttp-docUpgrade python3-aiohttpUpgrade python311-aiohttpUpgrade python313-aiohttp | May 31, 2024 | Apr 18, 2024 |
| Ubuntu | — | Upgrade python3-aiohttp (Ubuntu Pro) | Jul 11, 2025 | Apr 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub