CVE-2026-111750
2026-10-19
17h17 +00:00
17h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Inconsistent Interpretation of HTTP Requests The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. |
