CVE-2023-49082 aiohttp's ClientSession is vulnerable to CRLF injection via method
Attackers can inject CRLF sequences into HTTP requests via the method parameter, enabling request smuggling or header injection in aiohttp applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49082?
CVE-2023-49082 is a medium-severity vulnerability in aio-libs aiohttp, published on 29 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.
Which versions are affected by CVE-2023-49082?
3 open source packages ship an affected version, including aiohttp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aiohttp PyPI | All versions | 3.9.0 |
aiohttp PyPI | All versions | 3.9.0 |
aiohttp PyPI | All versions | 3.9.0 |
Linux distribution packages (2)
python-aiohttp SUSE:Linux Enterprise Module for Python 3 15 SP5 | All versions | 3.8.6-150400.10.11.1 |
python-aiohttp openSUSE:Leap 15.5 | All versions | 3.8.6-150400.10.11.1 |
Products include Aiohttp Aiohttp.
How do I fix CVE-2023-49082?
Upgrade aiohttp to 3.9.0 or later.
Is CVE-2023-49082 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-49082 exists.
Other vulnerabilities in aio-libs aiohttp
- CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
- CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
- CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp
- CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version
- CVE-2026-22815 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers
Sources
Also known as CLSA-2026-1771373593, CLSA-2026-1790062887, DEBIAN-CVE-2023-49082, ECHO-b440-a71d-cd51, GHSA-qvrw-v9rv-5rjx, PYSEC-2023-251 and 3 more.