AIOHTTP Request Smuggling Vulnerability in Python Parser

A request smuggling vulnerability has been identified in AIOHTTP versions through 3.12.13. The issue arises because the Python parser does not properly handle trailer sections of HTTP requests. This vulnerability is present in the pure Python version of AIOHTTP, excluding the typical C extensions, or when the AIOHTTP_NO_EXTENSIONS option is activated. An attacker could exploit this flaw to perform request smuggling attacks, potentially circumventing certain firewall or proxy defenses.

Impact

Exploitation of this vulnerability could lead to successful request smuggling attacks, allowing an attacker to bypass specific firewall or proxy protections.

Remediation

Users can upgrade to AIOHTTP version 3.12.14 or later to address this vulnerability.