CVE-2024-52304

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-444

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-523054.8UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create Us CVE-2024-523069.8FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes param CVE-2024-523075.6authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possib CVE-2024-523089.6The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh cod CVE-2024-523095.1SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerful CVE-2024-52316.5A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. Affected by this issue is CVE-2024-523116.3Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue CVE-2024-523125.4Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted oper CVE-2024-523134.3An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment res CVE-2024-523144.9A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data fr CVE-2024-523169.8Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) S CVE-2024-523176.5Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 reques