Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
aio-libs/aiohttp
master @ 51da10a
297
Fixes
35
CVEs
CRITICAL
Peak severity
33.3%
Coverage
Highlights
Denial of Service: 119 prior fixes. Scrutinize any change in this area.
aiohttp/http_parser.py: most-fixed (62 issues). Treat as high-risk during review.
139 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
HTTP Request Smuggling: Inconsistent parser validation rules concerning Transfer-Encoding, Content-Length, and control characters have historically allowed request desynchronization. Multiple iterations of parser hardening were required to enforce strict RFC compliance and prevent smuggling.
Denial of Service: Unbounded resource usage during multipart/form-data POST ingestion could exhaust server memory. The client_max_size was historically reset per-field or ignored prior to fully reading chunk payloads, allowing memory exhaustion vectors.
Path Traversal: Static file serving components failed to properly canonicalize request paths before validating directory bounds, allowing attackers to escape the static root and read arbitrary local files.