aiohttp's ClientSession is vulnerable to CRLF injection via version
CVE-2023-49081

7.2HIGH

Key Information:

Vendor: Aio-libs
Status: Aiohttp
Vendor: CVE Published:; 30 November 2023

What is CVE-2023-49081?

The aiohttp framework, an asynchronous HTTP client/server for Python, suffers from an improper validation vulnerability. An attacker with control over the HTTP version of a request could exploit this flaw to modify the request by inserting arbitrary headers or creating new requests. This vulnerability has been addressed in version 3.9.0, which effectively mitigates the risk of such manipulations.