CVE-2023-47627 - CVE House
Back to Database
Status published Medium CVE-2023-47627

Request smuggling in aiohttp

Vulnerability Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-47627

Credits & Attribution

No credits recorded in the NVD database.

References

More from aio-libs

View All →
CVE-2025-69230
AIOHTTP Vulnerable to Cookie Parser Warning Storm
Low 2.7
CVE-2025-69229
AIOHTTP vulnerable to DoS through chunked messages
Medium 6.6
CVE-2025-69228
AIOHTTP vulnerable to denial of service through large payloads
Medium 6.6
CVE-2025-69227
AIOHTTP vulnerable to DoS when bypassing asserts
Medium 6.6
CVE-2025-69226
AIOHTTP allows for a brute-force leak of internal static filepath components
Medium 6.3

Affected Vendor

Affected Software

aiohttp
Vulnerable Versions:
< 3.8.6

Timeline

Official Publish: November 14th, 2023
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-444

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1565.002 Stored Data Manipulation
Impact
T1078 Valid Accounts
Defense Evasion