Skip to content

llhttp 8.1.1 vulnerable to request smuggling

Moderate
Dreamsorcerer published GHSA-pjjw-qhg8-p2p9 Nov 25, 2023

Package

pip aiohttp (pip)

Affected versions

<3.8.6

Patched versions

3.8.6

Description

Summary

llhttp 8.1.1 is vulnerable to two request smuggling vulnerabilities.
Details have not been disclosed yet, so refer to llhttp for future information.
The issue is resolved by using llhttp 9+ (which is included in aiohttp 3.8.6+).

Severity

Moderate

CVE ID

No known CVE

Weaknesses

Credits