CVE-2023-47627: AIOHTTP has problems in HTTP parser (the python one, not llhttp)
(updated )
The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling.
This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel).
References
- github.com/advisories/GHSA-gfw2-4jvh-wgfg
- github.com/aio-libs/aiohttp
- github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d
- github.com/aio-libs/aiohttp/releases/tag/v3.8.6
- github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg
- github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-246.yaml
- lists.debian.org/debian-lts-announce/2025/02/msg00002.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUSJVQ7OQ55RWL4XAX2F5EZ73N4ZSH6U
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDKQ6HM3KNDU4OQI476ZWT4O7DMSIT35
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQYQL6WV535EEKSNH7KRARLLMOW5WXDM
- nvd.nist.gov/vuln/detail/CVE-2023-47627
Code Behaviors & Features
Detect and mitigate CVE-2023-47627 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →