CVE-2024-52304
Fixed in a distro release EPSS <1%CVSS 6.3
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.
Products: aio-libs aiohttp, python aiohttp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | aiohttp | 3.10.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow | 2.10.3-r2 |
| Chainguard | airflow-bitnami-compat | 2.10.3-r2 |
| Chainguard | awx | 24.6.1-r2 |
| Chainguard | checkov | 3.2.432-r0 |
| Chainguard | dask-gateway | 2024.1.0-r11 |
| Chainguard | dask-gateway-server | 2024.1.0-r11 |
| Chainguard | kserve | 0.14.0-r0 |
| Chainguard | kserve-agent | 0.14.0-r0 |
| Chainguard | kserve-agent-compat | 0.14.0-r0 |
| Chainguard | kserve-manager | 0.14.0-r0 |
| Chainguard | kserve-manager-compat | 0.14.0-r0 |
| Chainguard | kserve-qpext | 0.14.0-r0 |
| Chainguard | kserve-qpext-compat | 0.14.0-r0 |
| Chainguard | kserve-router | 0.14.0-r0 |
| Chainguard | kserve-router-compat | 0.14.0-r0 |
| Chainguard | kserve-storage-controller | 0.14.0-r0 |
| Chainguard | py3-aiohttp | 3.10.11-r0 |
| Chainguard | py3-cassandra-medusa | 0.22.3-r1 |
| Chainguard | py3-cassandra-medusa-compat | 0.22.3-r1 |
| Chainguard | py3.13-scanner-test-libraries-aiohttp | 0.0.1-r3 |
| Chainguard | request-1276 | 0.22.3-r1 |
| Chainguard | request-1276-compat | 0.22.3-r1 |
| Debian 11 | python-aiohttp | 3.7.4-1+deb11u1 |
| Debian 12 | python-aiohttp | 3.8.4-1+deb12u1 |
| Debian 13 | python-aiohttp | 3.10.11-1 |
| Debian 14 | python-aiohttp | 3.10.11-1 |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.6-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.6-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.3-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.3-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20250115-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20250115-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.11-aiohttp | 0:3.10.11-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.11-aiohttp | 0:3.10.11-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.11-aiohttp-debuginfo | 0:3.10.11-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.11-aiohttp-debuginfo | 0:3.10.11-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.11-aiohttp-debugsource | 0:3.10.11-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.11-aiohttp-debugsource | 0:3.10.11-1.el8ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.5.1-2.el8ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.5.1-2.el9ap |
| Red Hat ansible automation platform 2.5 | receptor-debuginfo | 0:1.5.1-2.el8ap |
| Red Hat ansible automation platform 2.5 | receptor-debuginfo | 0:1.5.1-2.el9ap |
| Red Hat ansible automation platform 2.5 | receptor-debugsource | 0:1.5.1-2.el8ap |
| Red Hat ansible automation platform 2.5 | receptor-debugsource | 0:1.5.1-2.el9ap |
| Red Hat ansible automation platform 2.5 | receptorctl | 0:1.5.1-2.el9ap |
| Red Hat ansible automation platform 2.5 | receptorctl | 0:1.5.1-2.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.5.1-2.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.5.1-2.el9ap |
| Red Hat ansible automation platform developer 2.5 | receptorctl | 0:1.5.1-2.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptorctl | 0:1.5.1-2.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.5.1-2.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.5.1-2.el8ap |
| Red Hat ansible automation platform inside 2.5 | receptorctl | 0:1.5.1-2.el8ap |
| Red Hat ansible automation platform inside 2.5 | receptorctl | 0:1.5.1-2.el9ap |
| Red Hat satellite 6.16 | python-aiohttp | 0:3.10.11-1.el9pc |
| Red Hat satellite 6.16 | python-aiohttp | 0:3.10.11-1.el8pc |
| Red Hat satellite 6.16 | python-aiohttp-debugsource | 0:3.10.11-1.el8pc |
| Red Hat satellite 6.16 | python-aiohttp-debugsource | 0:3.10.11-1.el9pc |
| Red Hat satellite 6.16 | python3.11-aiohttp | 0:3.10.11-1.el8pc |
| Red Hat satellite 6.16 | python3.11-aiohttp | 0:3.10.11-1.el9pc |
| Red Hat satellite 6.16 | python3.11-aiohttp-debuginfo | 0:3.10.11-1.el8pc |
| Red Hat satellite 6.16 | python3.11-aiohttp-debuginfo | 0:3.10.11-1.el9pc |
| Red Hat satellite capsule 6.16 | python-aiohttp | 0:3.10.11-1.el8pc |
| Red Hat satellite capsule 6.16 | python-aiohttp | 0:3.10.11-1.el9pc |
| Red Hat satellite capsule 6.16 | python-aiohttp-debugsource | 0:3.10.11-1.el8pc |
| Red Hat satellite capsule 6.16 | python-aiohttp-debugsource | 0:3.10.11-1.el9pc |
| Red Hat satellite capsule 6.16 | python3.11-aiohttp | 0:3.10.11-1.el8pc |
| Red Hat satellite capsule 6.16 | python3.11-aiohttp | 0:3.10.11-1.el9pc |
| Red Hat satellite capsule 6.16 | python3.11-aiohttp-debuginfo | 0:3.10.11-1.el8pc |
| Red Hat satellite capsule 6.16 | python3.11-aiohttp-debuginfo | 0:3.10.11-1.el9pc |
| SUSE Linux Enterprise Module for Public Cloud 15 SP2 | python-aiohttp | 3.6.0-150100.3.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP3 | python-aiohttp | 3.6.0-150100.3.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.6.0-150100.3.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-aiohttp | 3.9.3-150400.10.27.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | python-aiohttp | 3.6.0-150100.3.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP6 | python-aiohttp | 3.6.0-150100.3.18.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP5 | python-aiohttp | 3.9.3-150400.10.27.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | python-aiohttp | 3.9.3-150400.10.27.1 |
| Ubuntu Pro 18.04 LTS | python-aiohttp | 3.0.1-1ubuntu0.1~esm5 |
| Ubuntu Pro 20.04 LTS | python-aiohttp | 3.6.2-1ubuntu1+esm4 |
| Ubuntu Pro 22.04 LTS | python-aiohttp | 3.8.1-4ubuntu0.2+esm1 |
| Ubuntu Pro 24.04 LTS | python-aiohttp | 3.9.1-1ubuntu0.1+esm1 |
| Wolfi | airflow | 2.10.3-r2 |
| Wolfi | airflow-bitnami-compat | 2.10.3-r2 |
| Wolfi | checkov | 3.2.432-r0 |
| Wolfi | dask-gateway | 2024.1.0-r11 |
| Wolfi | dask-gateway-server | 2024.1.0-r11 |
| Wolfi | kserve | 0.14.0-r0 |
| Wolfi | kserve-agent | 0.14.0-r0 |
| Wolfi | kserve-agent-compat | 0.14.0-r0 |
| Wolfi | kserve-manager | 0.14.0-r0 |
| Wolfi | kserve-manager-compat | 0.14.0-r0 |
| Wolfi | kserve-qpext | 0.14.0-r0 |
| Wolfi | kserve-qpext-compat | 0.14.0-r0 |
| Wolfi | kserve-router | 0.14.0-r0 |
| Wolfi | kserve-router-compat | 0.14.0-r0 |
| Wolfi | kserve-storage-controller | 0.14.0-r0 |
| Wolfi | py3-aiohttp | 3.10.11-r0 |
| Wolfi | py3-cassandra-medusa | 0.22.3-r1 |
| Wolfi | py3-cassandra-medusa-compat | 0.22.3-r1 |
| openSUSE Leap 15.5 | python-aiohttp | 3.6.0-150100.3.18.1 |
| openSUSE Leap 15.5 | python-aiohttp | 3.9.3-150400.10.27.1 |
| openSUSE Leap 15.6 | python-aiohttp | 3.9.3-150400.10.27.1 |