aiohttp@3.14.0

Affected versions of this package are vulnerable to Improper Resource Shutdown or Release in the payload response resources when a client disconnects during a write operation. An attacker can cause temporary resource exhaustion by repeatedly initiating connections and disconnecting mid-transfer, leading to open files or similar resources not being released until garbage collection occurs.

Upgrade aiohttp to version 3.14.1 or higher.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) during cleanup. An attacker can exhaust system memory by sending a specially crafted compressed payload that is decompressed into memory in a single chunk.

Upgrade aiohttp to version 3.14.1 or higher.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the C HTTP parser when the max_line_size check is bypassed for fragmented lines. An attacker can cause excessive memory consumption by sending oversized HTTP request lines, potentially resulting in resource exhaustion and service disruption.

Upgrade aiohttp to version 3.14.1 or higher.

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the server_hostname parameter handling during HTTPS connection reuse. An attacker can bypass intended TLS SNI checks by reusing an existing connection with a different server_hostname, potentially allowing connections to unintended hosts.

Upgrade aiohttp to version 3.14.1 or higher.

Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the CookieJar.save and CookieJar.load functions. An attacker can cause cookies intended for a specific host to be sent to subdomains by persisting and restoring cookies, potentially leading to unintended information disclosure.

Upgrade aiohttp to version 3.14.1 or higher.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the DigestAuthMiddleware class when authentication responses are sent after following cross-origin redirects. An attacker can obtain authentication digests by leveraging an open redirect or similar issue to redirect a client to an attacker-controlled domain.

Note: This is only exploitable if the client follows redirects to attacker-controlled domains.

Upgrade aiohttp to version 3.14.1 or higher.