Loading vulnerability…
HTTP request smuggling in aiohttp's pure-Python parser
CVE-2024-52304 is an HTTP request-smuggling vulnerability in aiohttp versions before 3.10.11. The pure-Python HTTP parser incorrectly handles newlines in chunk extensions, potentially allowing inconsistent interpretation of HTTP requests and bypass of certain firewall or proxy protections. Affected configurations use aiohttp without its usual C extensions or enable AIOHTTP_NO_EXTENSIONS. aiohttp 3.10.11 fixes the parsing defect.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may bypass firewall or proxy protections and permit unauthorized access to a web application. Potential consequences include web cache poisoning through incorrect association of requested resources with response content, and invocation of a script or page that returns client credentials. These outcomes depend on the deployment and surrounding HTTP infrastructure.
If you can’t patch tonight, do this now.
As a configuration-based workaround pending upgrade, avoid the affected pure-Python parser by installing and using aiohttp's usual C extensions and ensuring AIOHTTP_NO_EXTENSIONS is not enabled. Confirm that the runtime actually uses the C extensions; merely disabling the setting is insufficient if the extensions are absent.
Patch, then assume compromise.
Upgrade aiohttp to version 3.10.11 or a later fixed release. For Red Hat Ansible Automation Platform, apply the applicable vendor package or container updates: RHSA-2024:10766 and RHSA-2025:0340 for affected platform 2.5 packages, RHSA-2025:0341 for platform 2.5 containers, RHSA-2025:0722 for platform 2.4 containers, and RHSA-2025:0753 or RHSA-2025:1101 for affected execution-environment images. RHSA-2025:0340 supplies python3.11-aiohttp 3.10.11.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.