UnratedFix available
aiohttp 3.13.4
aiohttp 3.13.4 includes HTTP parser fixes that reject duplicate singleton headers to prevent potential host-based access control bypasses, and aligns request-header validation and parsing behavior. It also restores a synchronous method changed during the earlier decompression-bomb security fix.
Announced Group revision 1
Original source ↗github-aio-libs-aiohttp
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Rejected duplicate singleton headers (Host, Content-Type, Content-Length, etc.) in the C extension HTTP parser to match the pure Python parser behaviour, preventing potential host-based access control bypasses via parser differentials
aiohttp
Release notes from aiohttp
- Affected versions
- Not stated in this extraction
- Fixed versions
- 3.13.4
3.13.4
- Prerequisites
- Not stated in this extraction
Publisher severity
No explicit severity was extracted.
- Event
- #76184 · Revision 1
- Added to Heist Feed
- Publisher date