aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
References
Configurations
History
21 Aug 2025, 00:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
|
| First Time |
Aiohttp aiohttp
Fedoraproject Fedoraproject fedora Aiohttp |
|
| References | () https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397 - Patch | |
| References | () https://github.com/aio-libs/aiohttp/pull/8319 - Issue Tracking | |
| References | () https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8g - Vendor Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EXRGTN2WG7VZLUZ7WOXU5GQJKCPPHKP/ - Mailing List | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U/ - Mailing List | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIVBMPEY7WWOFMC3CWXFBRQPFECV4SW3/ - Mailing List |
Information
Published : 2024-04-18 15:15
Updated : 2025-08-21 00:45
NVD link : CVE-2024-27306
Mitre link : CVE-2024-27306
CVE.ORG link : CVE-2024-27306
JSON object : View
Products Affected
fedoraproject
- fedora
aiohttp
- aiohttp