Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
An overflow in aiohttp during Max-Age processing can prevent connections from closing properly, allowing an attacker to temporarily exhaust the connector pool until garbage collection runs.
In AIOHTTP, attackers sending absolute-form HTTP requests can spoof the request scheme. If an application relies on the scheme for security checks, attackers may bypass security logic by making unencrypted connections appear encrypted or vice versa.
A vulnerability in aiohttp allows a subdomain to remove the Host-Only flag from existing parent domain cookies, potentially weakening cookie scoping protections.
The pure-Python parser in aiohttp is vulnerable to HTTP request smuggling when running without standard C extensions. Applications can resolve this issue by updating aiohttp or switching to the default C parser.
A vulnerability in AIOHTTP allows attackers to exhaust file descriptors using specially crafted multipart requests. This can lead to resource exhaustion and potential denial of service.
A vulnerability in aiohttp allows an attacker to keep an idle connection open indefinitely before sending data because the keepalive timeout was not enforced during the initial portion of a request.
A vulnerability in AIOHTTP allowed shared cookies marked with the Secure attribute to potentially be transmitted over unencrypted requests. Upgrading to version 3.14.4 or later resolves this issue.
Multiple issues in aiohttp can cause excessive or unbounded memory usage and high CPU consumption when handling attacker-controlled requests, leading to resource exhaustion.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.