CVE-2024-52304

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.10.11

Description aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A flaw exists in the Python parser's handling of newlines within chunk extensions, potentially leading to request smuggling vulnerabilities. If a pure Python version of aiohttp is installed (without the usual C extensions) or AIOHTTP NO EXTENSIONS is enabled, an attacker may be able to exploit this issue to bypass certain firewalls or proxy protections. Request smuggling occurs when an attacker manipulates HTTP requests to trick the server into processing them in an unintended way. This can lead to various security consequences, including unauthorized access and data breaches.

Recommendations Upgrade aiohttp to version 3.10.11 or later.