CyberRota Analysis
AI-GeneratedThe AIOHTTP framework prior to version 3.14.2 is vulnerable to a request smuggling attack due to improper handling of WebSocket upgrade requests, which can allow an attacker to manipulate HTTP request parsing. This could lead to unauthorized actions or data exposure if the server-side component is exploited. Organizations using affected versions of AIOHTTP should prioritize upgrading to version 3.14.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.