Skip to content

llhttp 8.1.1 vulnerable to request smuggling

Moderate
Dreamsorcerer published GHSA-pjjw-qhg8-p2p9 Nov 25, 2023

Package

pip aiohttp (pip)

Affected versions

<3.8.6

Patched versions

3.8.6

Description

Summary

llhttp 8.1.1 is vulnerable to two request smuggling vulnerabilities.
Details have not been disclosed yet, so refer to llhttp for future information.
The issue is resolved by using llhttp 9+ (which is included in aiohttp 3.8.6+).

Severity

Moderate

CVE ID

No known CVE

Weaknesses

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. Learn more on MITRE.

Credits