high 7.5

CVE-2024-52304 json

aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

published 2024-11-18 23 mo ago modified 2026-09-10 1 mo ago also EUVD-2024-3218 , GHSA-8495-4g3g-x7pr , PYSEC-2026-1103

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits: 0; none known

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.

Patch / fix

fixed in 2 distros 4 links 1

pypi aiohttp 3.10.11
python aiohttp 3.10.11

debian ubuntu red hat suse

python-aiohttp Debian 12 3.8.4-1+deb12u1
python-aiohttp Debian 14, Debian 13 3.10.11-1

debian advisories DEBIAN-CVE-2024-52304

python-aiohttp Ubuntu Pro 18.04 LTS 3.0.1-1ubuntu0.1~esm5
python-aiohttp Ubuntu Pro 22.04 LTS 3.8.1-4ubuntu0.2+esm1
python-aiohttp Ubuntu Pro 24.04 LTS 3.9.1-1ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2024-52304

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python3.11-aiohttp ansible automation platform 2.5 3.10.11-1.el8ap
python3.11-aiohttp ansible automation platform 2.5 3.10.11-1.el9ap
automation-gateway-server ansible automation platform 2.5 2.5.20250115-1.el8ap
automation-gateway-server ansible automation platform 2.5 2.5.20250115-1.el9ap
automation-controller-venv-tower ansible automation platform 2.5 4.6.6-1.el8ap
automation-controller-venv-tower ansible automation platform 2.5 4.6.6-1.el9ap
python-aiohttp satellite capsule 6.16, satellite 6.16 3.10.11-1.el8pc
python-aiohttp satellite capsule 6.16, satellite 6.16 3.10.11-1.el9pc

red hat advisories RHSA-2025:0340 RHSA-2024:11574 RHSA-2024:10766

python-aiohttp SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 +3 more 3.6.0-150100.3.18.1
python-aiohttp SLE Module for Python 3 15 SP6, SLE Module for Python 3 15 SP5, SLE Module for Public Cloud 15 SP4 +2 more 3.9.3-150400.10.27.1

suse advisories SUSE-SU-2024:4110-1 SUSE-SU-2024:4077-1

github.com/aio-libs/aiohttp@259edc3 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-52304 updated 2026-11-07 cvss 5.9

aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

Red Hat OpenShift Lightspeed lightspeed-service-api-rhel9
affected: no fix available
Red Hat Enterprise Linux AI (RHEL AI) bootc-amd-rhel9, bootc-nvidia-rhel9, instructlab-amd-rhel9, bootc-azure-nvidia-rhel9, instructlab-nvidia-rhel9
affected: no fix available, no fix planned “Will not fix”
Red Hat Update Infrastructure 4 for Cloud Providers python-aiohttp
affected: no fix planned “Will not fix”
Red Hat Ansible Automation Platform Execution Environments ansible-automation-platform/ee-minimal-rhel8 2.17.7-3, ansible-automation-platform/ee-minimal-rhel8 2.17.8-3, ansible-automation-platform/ee-minimal-rhel8 2.18.1-3, ansible-automation-platform/ee-minimal-rhel8 2.18.2-3, ansible-automation-platform/ee-minimal-rhel9 2.17.8-4, ansible-automation-platform/ee-minimal-rhel9 2.18.1-4, +13 more
fixed: vendor fix RHSA-2025:1101
Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-automation-platform-24/lightspeed-rhel8-operator 2.4-33
fixed: vendor fix RHSA-2025:0722
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.11-aiohttp 3.10.11-1.el8ap, automation-controller-venv-tower 4.6.3-1.el8ap, ansible-automation-platform-25/lightspeed-rhel8 2.5.250107-1
fixed: vendor fix RHSA-2025:0341
Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.11-aiohttp 3.10.11-1.el9ap, automation-controller-venv-tower 4.6.3-1.el9ap
fixed: vendor fix RHSA-2024:10766
Red Hat Satellite 6.16 for RHEL 8 python-aiohttp 3.10.11-1.el8pc, python3.11-aiohttp 3.10.11-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-aiohttp 3.10.11-1.el9pc, python3.11-aiohttp 3.10.11-1.el9pc
fixed: vendor fix RHSA-2024:11574

show 1 more

Red Hat Ansible Automation Platform Execution Environments ansible-automation-platform/ee-29-rhel8 2.9.27-35, ansible-automation-platform/ee-29-rhel8 2.9.27-37, ansible-automation-platform/ansible-builder-rhel8 1.2.0-94, ansible-automation-platform/ansible-builder-rhel8 1.2.0-96, ansible-automation-platform/ansible-builder-rhel8 3.0.1-114, ansible-automation-platform/ansible-builder-rhel8 3.0.1-117, +2 more Red Hat Ansible Automation Platform 2 aap-cloud-metrics-collector-container, ansible-automation-platform-24/de-supported-rhel8, ansible-automation-platform-25/ansible-dev-tools-rhel8, ansible-automation-platform-24/ee-dellemc-openmanage-rhel8, ansible-automation-platform-24/platform-resource-runner-rhel8 Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-automation-platform-24/hub-rhel8 4.9.2-35, ansible-automation-platform-24/ee-29-rhel8 1.0.0-433, ansible-automation-platform-24/hub-web-rhel8 4.9.2-33, ansible-automation-platform-24/controller-rhel8 4.5.17-2, ansible-automation-platform-24/de-minimal-rhel8 1.0.7-55, ansible-automation-platform-24/ee-minimal-rhel8 1.0.0-809, +23 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-automation-platform-24/de-minimal-rhel9 1.0.7-56, ansible-automation-platform-24/ee-minimal-rhel9 1.0.0-808, ansible-automation-platform-24/de-supported-rhel9 1.0.7-64, ansible-automation-platform-24/ee-supported-rhel9 1.0.0-888, ansible-automation-platform-24/ansible-builder-rhel9 3.0.1-111, ansible-automation-platform-24/ansible-python-base-rhel9 1.0.0-697, +1 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.5.1-2.el8ap, receptorctl 1.5.1-2.el8ap, ansible-core 2.16.14-2.el8ap, ansible-test 2.16.14-2.el8ap, python3.11-yarl 1.13.1-1.el8ap, python3.11-aiodns 3.2.0-1.el8ap, +58 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.5.1-2.el9ap, receptorctl 1.5.1-2.el9ap, ansible-core 2.16.14-2.el9ap, ansible-test 2.16.14-2.el9ap, python3.11-yarl 1.13.1-1.el9ap, python3.11-aiodns 3.2.0-1.el9ap, +35 more

+2 more productsfewer

Red Hat Satellite 6.16 for RHEL 8 candlepin 4.4.20-1.el8sat, satellite 6.16.1-1.el8sat, python-yarl 1.13.1-1.el8pc, python-psycopg 3.2.3-1.el8pc, satellite-cli 6.16.1-1.el8sat, python-psycopg_c 3.2.3-1.el8pc, +17 more Red Hat Satellite 6.16 for RHEL 9 candlepin 4.4.20-1.el9sat, satellite 6.16.1-1.el9sat, python-yarl 1.13.1-1.el9pc, python-psycopg 3.2.3-1.el9pc, satellite-cli 6.16.1-1.el9sat, python-psycopg_c 3.2.3-1.el9pc, +17 more

not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 23 mo ago (2024-11-19)

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA	4.0	6.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	aiohttp	<3.10.11	3.10.11

Affected products

aio-libs aiohttp
python aiohttp

Classification

Weakness

CWE-444 Inconsistent Interpretation of HTTP Requests

References

github.com /aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71
web, patch
github.com /aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr
web, vendor-advisory
lists.debian.org /debian-lts-announce/2025/02/msg00002.html
web
nvd.nist.gov /vuln/detail/CVE-2024-52304
advisory
github.com /aio-libs/aiohttp
package
pypi.org /project/aiohttp
package
github.com /advisories/GHSA-8495-4g3g-x7pr
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary