CVSS Score of 10 (low)


Published Jul 19, 2023
Updated: Nov 22, 2023
CWE ID 444


CVE-2023-37276 is a vulnerability that affects the aiohttp asynchronous HTTP client/server framework for asyncio and Python. Versions up to 3.8.4 are bundled with llhttp v6.0.6, which contains vulnerable code used by aiohttp for its HTTP request parser when installed from a wheel. This vulnerability specifically impacts users of aiohttp as an HTTP server, while those using it as an HTTP client library are not affected. Exploiting this vulnerability allows attackers to send crafted HTTP requests that can lead to HTTP request smuggling. The issue has been addressed in version 3.8.5, and users are advised to upgrade or alternatively disable the llhttp parser implementation by reinstalling aiohttp with the AIOHTTP_NO_EXTENSIONS=1 environment variable. The potential danger posed by this vulnerability is high, with a base severity rating of 'HIGH' and an impact on integrity being 'HIGH' according to NIST's CVSS score of 7.5 out of 10.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-37276 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options