aiohttp

aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

AIOHTTP has CRLF injection through multipart part content type header construction

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser

AIOHTTP vulnerable to brute-force leak of internal static file path components

aiohttp is vulnerable to directory traversal

aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

AIOHTTP's unicode processing of header values could cause parsing discrepancies

AIOHTTP vulnerable to denial of service through large payloads