CVE-2021-21330 Open redirect vulnerability in aiohttp
Attackers can redirect users to malicious sites via crafted links in aiohttp web servers using the normalize_path_middleware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21330?
CVE-2021-21330 is a low-severity vulnerability in Debian Debian Linux, published on 26 Feb 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
Weakness: CWE-601
Which versions are affected by CVE-2021-21330?
3 open source packages ship an affected version, including aiohttp. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
aiohttp PyPI | All versions | 3.7.4 |
aiohttp PyPI | All versions | 3.7.4 |
aiohttp PyPI | All versions | 3.7.4 |
Linux distribution packages (14)
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP1 | All versions | 3.4.4-3.6.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP1 | All versions | 3.6.0-150100.3.9.1 |
python-typing_extensions SUSE:Linux Enterprise Module for Public Cloud 15 SP1 | All versions | 3.10.0.0-150100.3.3.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP2 | All versions | 3.4.4-3.6.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP2 | All versions | 3.6.0-150100.3.9.1 |
python-typing_extensions SUSE:Linux Enterprise Module for Public Cloud 15 SP2 | All versions | 3.10.0.0-150100.3.3.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP3 | All versions | 3.6.0-150100.3.9.1 |
python-typing_extensions SUSE:Linux Enterprise Module for Public Cloud 15 SP3 | All versions | 3.10.0.0-150100.3.3.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.6.0-150100.3.9.1 |
python-typing_extensions SUSE:Linux Enterprise Module for Server Applications 15 SP4 | All versions | 3.10.0.0-150400.3.2.1 |
python-aiohttp openSUSE:Leap 15.3 | All versions | 3.6.0-150100.3.9.1 |
python-aiohttp openSUSE:Leap 15.4 | All versions | 3.6.0-150100.3.9.1 |
python-typing_extensions openSUSE:Leap 15.4 | All versions | 3.10.0.0-150400.3.2.1 |
python-aiohttp openSUSE:Tumbleweed | All versions | 3.8.5-2.1 |
Products include Aiohttp Aiohttp, Debian Debian Linux, Fedoraproject Fedora.
How do I fix CVE-2021-21330?
Upgrade aiohttp to 3.7.4 or later.
Is CVE-2021-21330 being exploited?
There is no known exploitation of CVE-2021-21330 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
- CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
- CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp
- CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version
- CVE-2026-22815 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers
Sources
Also known as AZL-44805, DEBIAN-CVE-2021-21330, DSA-4864-1, GHSA-v6wp-4m6f-gcjg, MGASA-2021-0161, PYSEC-2021-76 and 5 more.