{"action":"Upgrade aiohttp to 3.7.4 or later.","affected":[{"fixed":"3.7.4","introduced":"0"}],"component":"aiohttp","cve_ids":["CVE-2021-21330"],"ecosystem":"PyPI","epss":0.01905,"exploited":false,"fixed_versions":["3.7.4"],"ghsa_id":"GHSA-v6wp-4m6f-gcjg","id":"tcs_01M5KFZEM08GK3P9QSEWZNE8T9","modified_at":"2026-07-08T06:27:43.955932046Z","published_at":"2021-02-26T02:11:57Z","references":["https://osv.dev/vulnerability/GHSA-v6wp-4m6f-gcjg","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg","https://nvd.nist.gov/vuln/detail/CVE-2021-21330","https://github.com/aio-libs/aiohttp/commit/2545222a3853e31ace15d87ae0e2effb7da0c96b","https://github.com/aio-libs/aiohttp","https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst#374-2021-02-25","https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2021-76.yaml","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5","https://pypi.org/project/aiohttp","https://security.gentoo.org/glsa/202208-19","https://www.debian.org/security/2021/dsa-4864"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"GHSA-v6wp-4m6f-gcjg","url":"https://osv.dev/vulnerability/GHSA-v6wp-4m6f-gcjg"}],"summary":"`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)"}