CVE-2023-37276
CVSS Score of 10 (low)
Details
Summary
CVE-2023-37276 is a vulnerability that affects the aiohttp asynchronous HTTP client/server framework for asyncio and Python. Versions up to 3.8.4 are bundled with llhttp v6.0.6, which contains vulnerable code used by aiohttp for its HTTP request parser when installed from a wheel. This vulnerability specifically impacts users of aiohttp as an HTTP server, while those using it as an HTTP client library are not affected. Exploiting this vulnerability allows attackers to send crafted HTTP requests that can lead to HTTP request smuggling. The issue has been addressed in version 3.8.5, and users are advised to upgrade or alternatively disable the llhttp parser implementation by reinstalling aiohttp with the AIOHTTP_NO_EXTENSIONS=1 environment variable. The potential danger posed by this vulnerability is high, with a base severity rating of 'HIGH' and an impact on integrity being 'HIGH' according to NIST's CVSS score of 7.5 out of 10.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions