Vulnerabilidades do Pip Aiohttp
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Pip Aiohttp: 2 registro(s), com versões afetadas e correções.
CVE-2026-111064
Alta · 8.2
CWE-770 19/10/2026
aiohttp server lacks an initial request/header timeout
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.
CVE-2026-111063
Média · 6.3
CWE-311 19/10/2026
AIOHTTP: Secure attribute not enforced for shared cookie
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.