How many CVEs have patched __init__?

13 published CVEs changed __init__ in aio-libs/aiohttp, in 24 distinct patches totalling 151 changed lines, between 2023 and 2026.

What is the latest CVE that changed __init__?

CVE-2026-69243 (AIOHTTP: HTTP request smuggling via WebSocket upgrade), published 2026-08-03, changed lines 296 of aiohttp/http_parser.py.

How does __init__ compare to the rest of aio-libs/aiohttp?

aio-libs/aiohttp has 42 CVEs with a located fix in total; 13 of them changed __init__.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

__init__ in aio-libs/aiohttp: Patched by 13 CVEs

AIOHTTP: HTTP request smuggling via WebSocket upgrade

CVE-2026-69243 · aiohttp/http_parser.py · line 296 · +1 −0

Medium · CVSS 6.3

EPSS 0.4%2026-08-03

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

CVE-2026-59881 · aiohttp/_websocket/reader_py.py · lines 141–142 · +2 −2

Medium · CVSS 6.9

EPSS 0.5%2026-07-30

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

CVE-2026-54273 · aiohttp/http_parser.py · lines 278–306 · +4 −0 in 2 hunks

Medium · CVSS 6.6

EPSS 0.5%2026-06-22

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

CVE-2026-54273 · aiohttp/web_protocol.py · lines 197–213 · +8 −0 in 2 hunks

Medium · CVSS 6.6

EPSS 0.5%2026-06-22

AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

CVE-2026-54276 · aiohttp/client_middleware_digest_auth.py · lines 210–211 · +2 −0

Medium · CVSS 6.3

EPSS 0.3%2026-06-22

AIOHTTP: HTTP response splitting via \r in reason phrase

CVE-2026-34519 · aiohttp/web_exceptions.py · lines 104–105 · +2 −0

Low · CVSS 2.7

EPSS 0.4%2026-04-01

AIOHTTP: Multipart Header Size Bypass

CVE-2026-34516 · aiohttp/multipart.py · lines 662–683 · +12 −3 in 2 hunks

Medium · CVSS 6.6

EPSS 0.6%2026-04-01

AIOHTTP: Multipart Header Size Bypass

CVE-2026-34516 · aiohttp/web_protocol.py · lines 211–214 · +4 −0

Medium · CVSS 6.6

EPSS 0.6%2026-04-01

AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

CVE-2026-22815 · aiohttp/client.py · lines 308–408 · +2 −0 in 2 hunks

Medium · CVSS 6.9

EPSS 0.4%2026-04-01

AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

CVE-2026-22815 · aiohttp/http_exceptions.py · lines 83–88 · +5 −4

Medium · CVSS 6.9

EPSS 0.4%2026-04-01

AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

CVE-2026-22815 · aiohttp/http_parser.py · lines 236–792 · +8 −1 in 4 hunks

Medium · CVSS 6.9

EPSS 0.4%2026-04-01

AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

CVE-2026-22815 · aiohttp/web_protocol.py · line 191 · +1 −1

Medium · CVSS 6.9

EPSS 0.4%2026-04-01

AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

CVE-2026-34513 · aiohttp/connector.py · lines 859–1026 · +17 −6 in 3 hunks

Low · CVSS 2.7

EPSS 0.6%2026-04-01

AIOHTTP vulnerable to DoS through chunked messages

CVE-2025-69229 · aiohttp/streams.py · lines 151–155 · +5 −0

Medium · CVSS 6.6

EPSS 0.4%2026-01-05

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

CVE-2025-69223 · aiohttp/compression_utils.py · lines 194–199 · +6 −8

High · CVSS 7.5

EPSS 0.6%2026-01-05

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

CVE-2025-69223 · aiohttp/http_parser.py · lines 968–999 · +8 −1 in 2 hunks

High · CVSS 7.5

EPSS 0.6%2026-01-05

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

CVE-2025-69223 · aiohttp/multipart.py · lines 281–1098 · +3 −1 in 3 hunks

High · CVSS 7.5

EPSS 0.6%2026-01-05

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

CVE-2025-53643 · aiohttp/http_parser.py · lines 774–785 · +4 −0 in 2 hunks

Low · CVSS 1.7

EPSS 0.4%2025-07-14

Denial of service when trying to parse malformed POST requests in aiohttp

CVE-2024-30251 · aiohttp/multipart.py · lines 259–768 · +20 −2 in 3 hunks

High · CVSS 7.5

EPSS 1.1%2024-05-02

aiohttp's ClientSession is vulnerable to CRLF injection via method

CVE-2023-49082 · aiohttp/client_reqrep.py · lines 279–288 · +7 −1

Medium · CVSS 6.9

EPSS 0.9%2023-11-29

init

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track aio-libs/aiohttp CVEs