CVE-2023-49081

MediumCVSS 5.3/10Last modified Jun 23, 2026

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
aio-libs	aiohttp	< 3.9.0

References

Timeline

Published: Nov 30, 2023
Last modified: Jun 23, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-490825.3aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to mod CVE-2023-490837.5cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates CVE-2023-490848.8Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the dete CVE-2023-490858.8Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary S CVE-2023-490865.4Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in v CVE-2023-490877.5xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash CVE-2023-490884.8Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incom CVE-2023-490896.5Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffi CVE-2023-49094.3Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via CVE-2023-490906.1CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass CVE-2023-490919.8Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Co CVE-2023-490925.9RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key i