AIOHTTP Request Smuggling Vulnerability via Non-ASCII Decimals in Range Header

A request smuggling vulnerability has been identified in AIOHTTP versions through 3.13.2. The issue arises because the parser logic allows non-ASCII decimals to be included in the Range header. While there is no known impact, this behavior could potentially be exploited.

Impact

Exploitation could lead to a request smuggling vulnerability.

Reproduction

The vulnerability can be reproduced by sending a request with a Range header that includes non-ASCII decimal characters, such as Devanagari digits. The server will accept the header, but the non-ASCII characters could be used to manipulate the request in a way that exploits the smuggling vulnerability.

Remediation

Users can upgrade to AIOHTTP version 3.13.3 or later to address this vulnerability.