How many CVEs have a located fix in aio-libs/aiohttp?

42 published CVEs have a fix traced to functions in aio-libs/aiohttp, touching 90 functions across 25 files.

Which function in aio-libs/aiohttp has been patched by the most CVEs?

parse_headers in aiohttp/http_parser.py has been changed by 8 CVE fixes, from 2023 to 2026.

How large is a typical CVE fix in aio-libs/aiohttp?

The median fix changes 18 lines. 55% of fixes change 20 lines or fewer, and 33% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

python

#98 of 500 repositories

aio-libs/aiohttp

Name: aio-libs/aiohttp: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 3, 2026

42

CVE fixes located

Published CVEs

90

Functions patched

Distinct function sites

25

Files patched

Distinct source files

2021–2026

Years covered

By CVE publication date

Overview

42 published CVEs have a fix traced to functions in aio-libs/aiohttp, the earliest published in 2021. Those fixes changed 90 distinct functions across 25 files, in 416 patch hunks.

Among the 500 repositories tracked here, aio-libs/aiohttp ranks #98 by the number of CVEs with a located fix.

Most patched functions

Functions in aio-libs/aiohttp changed by the most CVE fixes.

Most patched files

Files in aio-libs/aiohttp changed by the most CVE fixes.

1aiohttp/http_parser.py12 CVEs · 10 functions
2aiohttp/web_request.py6 CVEs · 3 functions
3aiohttp/multipart.py5 CVEs · 15 functions
4aiohttp/client.py4 CVEs · 6 functions
5aiohttp/web_urldispatcher.py4 CVEs · 5 functions
6aiohttp/streams.py3 CVEs · 9 functions
7aiohttp/web_protocol.py3 CVEs · 5 functions
8aiohttp/cookiejar.py2 CVEs · 4 functions
9aiohttp/_websocket/reader_py.py2 CVEs · 3 functions
10aiohttp/client_reqrep.py2 CVEs · 2 functions

Fix size

How much code a CVE fix in aio-libs/aiohttp changes, with backports counted once.

18

Median lines changed

Added plus removed, per CVE

55%

Fixes of 20 lines or fewer

Share of CVE fixes

33%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in aio-libs/aiohttp, and the functions each fix changed.

AIOHTTP: HTTP request smuggling via WebSocket upgrade
CVE-2026-69243get_content_length and __init__
Medium · CVSS 6.3
EPSS 0.4%2026-08-03
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
CVE-2026-59881_ws_connect __init__
Medium · CVSS 6.9
EPSS 0.5%2026-07-30
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
CVE-2026-54273_reading_paused_for_msg_queue __init__start
Medium · CVSS 6.6
EPSS 0.5%2026-06-22
AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect
CVE-2026-54280write_eof
Low · CVSS 1.7
EPSS 0.5%2026-06-22
AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
CVE-2026-54278_read_nowait
Medium · CVSS 6.6
EPSS 0.5%2026-06-22
AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
CVE-2026-54276__call__DigestAuthMiddleware __init__
Medium · CVSS 6.3
EPSS 0.3%2026-06-22
AIOHTTP: Incomplete websocket frame payloads bypass memory limits
CVE-2026-54274_feed_data _handle_frame
Medium · CVSS 6.6
EPSS 0.5%2026-06-22
AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
CVE-2026-54279load _load_json_data save
Low · CVSS 1.3
EPSS 0.5%2026-06-22
AIOHTTP: CRLF injection in multipart headers
CVE-2026-50269_binary_headers
Low · CVSS 2.7
EPSS 0.5%2026-06-22
AIOHTTP vulnerable to cross-origin redirect with per-request cookies
CVE-2026-47265_connect_and_send_request
Medium · CVSS 6.6
EPSS 0.2%2026-06-02
AIOHTTP Vulnerable to Deserialization of Untrusted Data
CVE-2026-34993save _RestrictedCookieUnpickler
High · CVSS 7.3
EPSS 0.5%2026-06-02
AIOHTTP: Duplicate Host header accepted
CVE-2026-34525parse_headers RawRequestMessage
Medium · CVSS 6.3
EPSS 0.4%2026-04-01

Get an alert for each new aio-libs/aiohttp CVE, with the patched functions and AI-written analysis.

Monitor aiohttp CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

directus/directus42 CVEs freescout-help-desk/freescout42 CVEs getgrav/grav42 CVEs openstack/nova42 CVEs argoproj/argo-cd43 CVEs coollabsio/coolify43 CVEs grafana/grafana43 CVEs LimeSurvey/LimeSurvey43 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in aio-libs/aiohttp.

How many CVEs have a located fix in aio-libs/aiohttp?: 42 published CVEs have a fix traced to functions in aio-libs/aiohttp, touching 90 functions across 25 files.
Which function in aio-libs/aiohttp has been patched by the most CVEs?: parse_headers in aiohttp/http_parser.py has been changed by 8 CVE fixes, from 2023 to 2026.
How large is a typical CVE fix in aio-libs/aiohttp?: The median fix changes 18 lines. 55% of fixes change 20 lines or fewer, and 33% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track aio-libs/aiohttp CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing