CVE-2023-37276

Deeper analysis

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.8.4 and earlier bundle llhttp v6.0.6, and the vulnerable llhttp-based HTTP request parser is enabled by default when the package is installed from a wheel. The flaw affects only deployments that use aiohttp as an HTTP server via aiohttp.Application; client-side usage through aiohttp.ClientSession is unaffected. A crafted HTTP request can cause the server to misinterpret a header value, resulting in HTTP request smuggling (CWE-444) with a CVSS 3.1 score of 5.3.

An unauthenticated network attacker can send the malicious request to trigger the parser inconsistency. Successful exploitation allows the attacker to smuggle a second request past the server’s intended boundaries, achieving limited integrity impact without requiring user interaction or privileges.

The issue is fixed in aiohttp 3.8.5. The project advisory recommends upgrading; users who cannot upgrade may reinstall the package with the environment variable AIOHTTP_NO_EXTENSIONS=1 set, which disables the llhttp extension and falls back to the non-vulnerable pure-Python parser. The associated GitHub security advisory and commit reference confirm the scope and remediation steps. The EPSS score has remained flat at 0.0613 with no material increase after disclosure.