{"action":"Upgrade aiohttp to 3.9.2 or later.","affected":[{"fixed":"3.9.2","introduced":"0"}],"component":"aiohttp","cve_ids":["CVE-2024-23829"],"ecosystem":"PyPI","epss":0.01029,"exploited":false,"fixed_versions":["3.9.2"],"ghsa_id":"GHSA-8qpw-xqxj-h4r2","id":"tcs_01M5KF8WVVNKCXYMHKV14GCZ97","modified_at":"2026-09-10T03:50:04.962384666Z","published_at":"2024-01-29T22:30:07Z","references":["https://osv.dev/vulnerability/GHSA-8qpw-xqxj-h4r2","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg","https://nvd.nist.gov/vuln/detail/CVE-2024-23829","https://github.com/aio-libs/aiohttp/pull/3235","https://github.com/aio-libs/aiohttp/pull/8074","https://github.com/aio-libs/aiohttp/pull/8074/files","https://github.com/aio-libs/aiohttp/commit/33ccdfb0a12690af5bb49bda2319ec0907fa7827","https://github.com/aio-libs/aiohttp","https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2024-26.yaml","https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-8qpw-xqxj-h4r2","url":"https://osv.dev/vulnerability/GHSA-8qpw-xqxj-h4r2"}],"summary":"aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators"}