CVE-2023-49082

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.9.0

Description The issue is related to improper validation in the aiohttp HTTP client/server framework, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP method. This can lead to HTTP request smuggling if the attacker can control the HTTP version of the request. The vulnerability occurs when an attacker can control the HTTP method of the request, such as GET or POST.

Recommendations For versions prior to 3.9.0, update to version 3.9.0 to resolve the issue. As a temporary workaround, consider performing manual validation of user-provided values for the request method, such as restricting it to known values like GET or POST.