{"action":"Upgrade aiohttp to 3.8.0 or later.","affected":[{"fixed":"3.8.0","introduced":"0"}],"component":"aiohttp","cve_ids":["CVE-2023-47641"],"ecosystem":"PyPI","epss":0.00834,"exploited":false,"fixed_versions":["3.8.0"],"ghsa_id":"GHSA-xx9p-xxvh-7g8j","id":"tcs_01M5KG4XW154V0GYN9WKX0MHYP","modified_at":"2025-11-03T22:48:44.279957Z","published_at":"2023-11-14T20:36:25Z","references":["https://osv.dev/vulnerability/GHSA-xx9p-xxvh-7g8j","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xx9p-xxvh-7g8j","https://nvd.nist.gov/vuln/detail/CVE-2023-47641","https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371","https://github.com/aio-libs/aiohttp","https://github.com/aio-libs/aiohttp/releases/tag/v3.8.0","https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-247.yaml","https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"],"severity":{"label":"low","score":3.4},"sources":[{"source":"osv","source_id":"GHSA-xx9p-xxvh-7g8j","url":"https://osv.dev/vulnerability/GHSA-xx9p-xxvh-7g8j"}],"summary":"Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks"}