aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

CVE-2024-52304

What is CVE-2024-52304?

The aiohttp framework, utilized for asynchronous HTTP operations in Python, contains a vulnerability in its parsing of newlines in chunk extensions prior to version 3.10.11. This flaw may enable attackers to perform request smuggling attacks, particularly if users are running a version of aiohttp that lacks standard C extensions or if the 'AIOHTTP_NO_EXTENSIONS' option is enabled. Such attacks can potentially circumvent firewalls or proxy protections, exposing systems to further security threats. It is essential for users to upgrade to version 3.10.11 to mitigate this risk and enhance their application security.

References