Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-mwh4-6h8g-pg8w

Опубликовано: 01 апр. 2026
Источник: github
Github: Прошло ревью
CVSS4: 2.7

Описание

AIOHTTP has HTTP response splitting via \r in reason phrase

Summary

An attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits.

Impact

In the unlikely situation that an application allows untrusted data to be used in the response's reason parameter, then an attacker could manipulate the response to send something different from what the developer intended.


Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b

Пакеты

Наименование

aiohttp

pip
Затронутые версииВерсия исправления

<= 3.13.3

3.13.4

EPSS

Процентиль: 21%
0.00292
Низкий

2.7 Low

CVSS4

Дефекты

CWE-113

Связанные уязвимости

CVSS3: 5.3
ubuntu
4 месяца назад

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVSS3: 5.3
redhat
4 месяца назад

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVSS3: 5.3
nvd
4 месяца назад

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVSS3: 5.3
debian
4 месяца назад

AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...

CVSS3: 5.3
fstec
5 месяцев назад

Уязвимость HTTP-клиента aiohttp, связанная с непринятием мер по обработке последовательностей CRLF в HTTP-заголовках, позволяющая нарушителю внедрить произвольные HTTP-заголовки

EPSS

Процентиль: 21%
0.00292
Низкий

2.7 Low

CVSS4

Дефекты

CWE-113