AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-aiohttpNo solution exists | Jul 16, 2025 | Jul 14, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.12Upgrade Splunk Enterprise to version 9.4.8Upgrade Splunk Enterprise to version 9.3.9Upgrade Splunk Enterprise to version 10.0.3 | Mar 20, 2026 | Jul 14, 2025 |
| Suse | — | Upgrade python3-aiohttpUpgrade python311-aiohttp | Dec 5, 2025 | Sep 3, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub