{"action":"Upgrade aiohttp to 3.9.2 or later.","affected":[{"fixed":"3.9.2","introduced":"0"}],"component":"aiohttp","cve_ids":["CVE-2024-23829"],"ecosystem":"PyPI","epss":0.01029,"exploited":false,"fixed_versions":["3.9.2"],"ghsa_id":"GHSA-8qpw-xqxj-h4r2","id":"tcs_01M5KGMSNH3V2NZ4GERG80W55T","modified_at":"2024-02-06T20:41:46.176337Z","published_at":"2024-01-29T23:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-26","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2","https://github.com/aio-libs/aiohttp/pull/8074","https://github.com/aio-libs/aiohttp/commit/33ccdfb0a12690af5bb49bda2319ec0907fa7827","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2024-26","url":"https://osv.dev/vulnerability/PYSEC-2024-26"}],"summary":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must tri"}