Repository navigation
chore(deps): update dependency aiohttp to v3.14.4 [security] - #81
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/pypi-aiohttp-vulnerability
branch
from
October 15, 2026 17:25
4766d6b to
824f3b1
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/pypi-aiohttp-vulnerability
branch
from
October 20, 2026 13:40
824f3b1 to
144ecff
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/pypi-aiohttp-vulnerability
branch
2 times, most recently
from
October 28, 2026 02:31
144ecff to
99b091e
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/pypi-aiohttp-vulnerability
branch
2 times, most recently
from
October 30, 2026 06:00
99b091e to
48c6395
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
==3.13.5→==3.14.4AIOHTTP is Vulnerable to Deserialization of Untrusted Data
CVE-2026-34993 / GHSA-jg22-mg44-37j8
More information
Details
Summary
Using
CookieJar.load()with untrusted input may allow arbitrary code execution.Impact
Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.
Workaround
If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading.
Patch: aio-libs/aiohttp@dcf40f3
Severity
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
CVE-2026-47265 / GHSA-hg6j-4rv6-33pg
More information
Details
Summary
Cookies set with the
cookiesparameter on requests are sent after following a cross-origin redirect.Impact
If a developer uses the
cookiesparameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.Workaround
If unable to upgrade, using a
Cookieheader in theheadersparameter is not vulnerable.Patch: aio-libs/aiohttp@f54c408
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
aiohttp: CRLF injection in multipart headers
CVE-2026-50269 / GHSA-m6qw-4cw2-hm4m
More information
Details
Summary
Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.
Impact
In the unlikely situation that an application is passing user-controlled strings into
MultipartWriter.append(headers=...)orPayload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request.Workaround
Sanitise such user input.
Patch: aio-libs/aiohttp@bf88077
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
CVE-2026-54278 / GHSA-g3cq-j2xw-wf74
More information
Details
Summary
During cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.
Impact
An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case).
Workaround
Disable compression if unable to upgrade.
Patch: aio-libs/aiohttp@4f7480e
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
CVE-2026-54280 / GHSA-9x8q-7h8h-wcw9
More information
Details
Summary
Payload resources are not closed correctly when a client disconnects in the middle of a write.
Impact
If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file.
Patch: aio-libs/aiohttp@a762eda
Severity
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
CVE-2026-54279 / GHSA-2fqr-mr3j-6wp8
More information
Details
Summary
Host-only cookies that are saved with
CookieJar.save()and then restored later withCookieJar.load()lose their host-only status.Impact
Host-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed.
Patch: aio-libs/aiohttp@a329a7a
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
CVE-2026-54276 / GHSA-hpj7-wq8m-9hgp
More information
Details
Summary
DigestAuthMiddlewarecan send an authentication response after following a cross-origin redirect.Impact
If the client follows a redirect (the default option) to an attacker controlled domain, the attacker may be able to extract the auth digest.
This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse.
Workaround
Disable
follow_redirectsif this is a concern.Patch: aio-libs/aiohttp@38d1606
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
CVE-2026-54273 / GHSA-4fvr-rgm6-gqmc
More information
Details
Summary
No limit was present on the number of pipelined requests that could be queued.
Impact
An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.
Patch: aio-libs/aiohttp@dfdfa9d
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
CVE-2026-54275 / GHSA-4m7w-qmgq-4wj5
More information
Details
Summary
The
server_hostnameTLS SNI check can be bypassed when an existing connection is reused.Impact
If an application makes multiple requests to the same domain, but with different per-request
server_hostnameparameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check.Workaround
Disable keep_alive if you need to change the
server_hostnamecheck between requests.Patch: aio-libs/aiohttp@0ca2b6c
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
aiohttp: Incomplete websocket frame payloads bypass memory limits
CVE-2026-54274 / GHSA-xcgm-r5h9-7989
More information
Details
Summary
If an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use.
Impact
If a web application has WebSocket endpoints, it may be possible for an attacker to execute a DoS attack through excessive memory use.
Patch: aio-libs/aiohttp@14b6ee8
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
CVE-2026-54277 / GHSA-63hw-fmq6-xxg2
More information
Details
Summary
It is possible to bypass the max_line_size check in parts of an HTTP request in the C parser.
Impact
If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS.
Patch: aio-libs/aiohttp@5ab61bb
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
CVE-2026-59881 / GHSA-mq44-7p77-q5h7
More information
Details
Summary
The client accepts and decompresses frames with the RSV1 bit set even when the
permessage-deflateextension was not negotiated.Impact
A client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.
Patch: aio-libs/aiohttp@47fb6ae
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: HTTP request smuggling via WebSocket upgrade
CVE-2026-69243 / GHSA-mfx4-hv73-q22v
More information
Details
Summary
The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.
Impact
If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.
Patch: aio-libs/aiohttp@6ae358f
Severity
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
CVE-2026-69244 / GHSA-cq5v-8q36-5273
More information
Details
Summary
An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.
Impact
An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.
Workaround
If unable to upgrade, the Python parser is unaffected and can be used with
AIOHTTP_NO_EXTENSIONS=1.Patch: aio-libs/aiohttp@49f65d5
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: Secure attribute not enforced for shared cookie
CVE-2026-111063 / GHSA-494j-54xm-rwp3
More information
Details
Summary
The Secure attribute was not being enforced for the shared cookie.
Impact
It may be possible to send a shared cookie marked Secure through an unencrypted request.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
aiohttp server lacks an initial request/header timeout
CVE-2026-111064 / GHSA-5wr8-gcqf-gqf3
More information
Details
Summary
The keepalive timeout was not used during the initial portion of a request.
Impact
An attacker could keep an idle connection open indefinitely before sending any data.
Workaround
Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
CVE-2026-123817 / GHSA-2g87-pp6c-29x5
More information
Details
Summary
While reassembling a WebSocket frame that arrived across many small transport reads, the reader kept one
bytesobject per read with no bound on the count. The per-object overhead is many times larger than the payload bytes, so a frame delivered a few bytes at a time could use far more memory thanmax_msg_sizeallows.Impact
An attacker could cause excessive memory use in a WebSocket server, or a malicious server against a client, by sending a frame in a large number of tiny segments.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: Pure-Python parser request smuggling
CVE-2026-111750 / GHSA-pqxq-w44r-73xw
More information
Details
Summary
The pure Python parser is vulnerable to an HTTP request smuggling attack.
Impact
If users are using the Python parser (
AIOHTTP_NO_EXTENSIONS, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack.Workaround
Switch to the default C parser.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111065 / GHSA-6cjc-53gc-5rqm
More information
Details
Summary
An overflow in Max-Age processing can skip closing a connection.
Impact
An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
CVE-2026-111749 / GHSA-gx76-c99x-2c96
More information
Details
Summary
A subdomain can remove the Host-Only flag from an existing cookie to a parent domain.
Impact
A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-111748 / GHSA-f9xw-jh8m-3mwq
More information
Details
Summary
An attacker sending an absolute-form request can spoof the scheme used.
Impact
If user code depends on the
Request.schemeattribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa.Workaround
A WAF rule to reject absolute-form requests (legitimate requests should only use this form for proxies).
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
AIOHTTP: File descriptor exhaustion in multipart requests
CVE-2026-111066 / GHSA-9xw5-w5jj-pvcg
More information
Details
Summary
An attacker can exhaust file descriptors with specially crafted multipart requests.
Impact
If a handler uses
Request.post(), it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
aio-libs/aiohttp (aiohttp)
v3.14.4Compare Source
===================
Features
Added :class:
aiohttp.UploadTrackerfor observing a client request's upload progress -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13579.Switched
application/x-www-form-urlencodedparsing in:meth:
~aiohttp.web.BaseRequest.postto the faster :func:yarl.query_to_pairsparser and added the
client_max_fieldsargument to:class:
~aiohttp.web.Application(default1000) to cap the number of formfields accepted by :meth:
~aiohttp.web.BaseRequest.post. Forms with morethan 1000 fields now receive a
413response unless the cap is raised;0disables it -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
13738.Added constants to
aiohttp.hdrsfor widely used headers: those thatbrowsers send on every request (
Sec-Fetch-*,Sec-CH-UA*,Sec-GPC,Upgrade-Insecure-Requests,Priority), W3C trace context(
traceparent,tracestate,baggage), response security, reportingand caching headers, the remaining RFC 9110 and RFC 9530 fields,
Content-IDand common de facto proxy and application headers, andgrouped the constants by where the header is defined. The C parser returns
these names as the shared :class:
~multidict.istrconstants instead of new:class:
strobjects, which made parsing a typical browser request about9% cheaper -- by :user:
asvetlov.Related issues and pull requests on GitHub:
:issue:
13886.Bug fixes
Remove overlapping slots in
RequestHandler,fix broken slots inheritance in :py:class:
~aiohttp.web.StreamResponse.Related issues and pull requests on GitHub:
:issue:
6547.Fixed a segmentation fault in the C HTTP parser on Python 3.12 and newer when payload decompression raised an error while pending decompressed data was being drained, as seen with
brotlicffi1.2 -- by :user:bdraco.Related issues and pull requests on GitHub:
:issue:
13203, :issue:13249.Rejected control characters in the request target in the pure-Python HTTP parser,
matching the llhttp-backed parser, which already refuses them
-- by :user:
arshsmith1.Related issues and pull requests on GitHub:
:issue:
13212.Stripped the trailing whitespace from header values in the C HTTP parser,
so that it matches the pure-Python parser and :rfc:
9110#section-5.5-- by :user:
LuShadowX.Related issues and pull requests on GitHub:
:issue:
13246.Fixed the WebSocket reader rejecting a compressed data frame with close code 1002 when a control frame arrived before the first data frame (regression in 3.14.2) -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13274.Fixed internally retried requests sending a truncated body when the request
data was a file object.
Related issues and pull requests on GitHub:
:issue:
13329, :issue:13330.Fixed event loop state possibly being corrupted on Python 3.12+ -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13346.Fixed the HTTP parser raising :exc:
~aiohttp.ClientPayloadErrorwhen a fully receivedContent-Lengthbody was pending completion -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13348.Bounded the per-read object overhead the WebSocket reader retains while reassembling a frame delivered across many small reads; the reads are joined once when the frame completes, and folded into a single buffer if they exceed a fragment cap, so a frame dribbled in tiny reads cannot pin unbounded per-read overhead -- by :user:
Dreamsorcererand :user:bdraco.Related issues and pull requests on GitHub:
:issue:
13352, :issue:13488.Fixed requests pipelined behind a request whose upgrade the handler declined
going unanswered once there were more of them than the per-connection queue
holds. With the pure-Python parser the same requests were also served more
than once -- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
13356.Reduced CPU consumption when encountering many concatenated members in a compressed payload and rejected large amounts of members -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13362.Fixed excessive memory consumption with small WebSocket messages -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13393.Fixed an integer overflow on too large messages -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13415.Switched multipart handling to use spooled temporary files to reduce number of file descriptors needed -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13426.Fixed a limit on message tail after an upgrade request -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13501.Fixed some edge case handling in multipart parts using base 64 encoding -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13509.Fixed Cython 3.3.0 failing to compile the WebSocket reader: dropped the
Final[...]annotation fromALLOWED_CLOSE_CODESand theintannotation from the local
start_posinWebSocketReader._feed_data,both of which conflicted with declarations in
reader_c.pxdunderCython 3.3.0 -- by :user:
Georgefifth.Related issues and pull requests on GitHub:
:issue:
13520.Fixed the WebSocket reader accepting a new data frame injected between the
fragments of an in-progress message; per :rfc:
6455#section-5.4every frameafter the first fragment and before the
FINmust be a continuation, andsuch a stream is now rejected as a protocol error -- by :user:
arshsmith1.Related issues and pull requests on GitHub:
:issue:
13553.Fixed a connection being eligible for reuse after its request was cancelled
or failed while waiting for a
100 Continueresponse or finalizing thebody; the request headers were already sent, so reusing the connection
corrupted the next request on it -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13579.Fixed
BaseRequest.http_rangenot accepting case-insensitive range units -- by :user:Manny7717.Related issues and pull requests on GitHub:
:issue:
13580, :issue:13581.Fixed
CookieJar.update_cookies()to copy user-passed mutableMorselobjects -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13637.Fixed unbounded memory growth on a client WebSocket connection. A frame
protocol error detaches the reader but leaves the connection upgraded, so a
peer could stream unlimited data into an internal buffer when the application
never called :meth:
~aiohttp.ClientWebSocketResponse.receive; that data isnow discarded, since nothing can parse it. Data arriving before the reader is
installed is bounded by
read_bufsize, which now applies to this buffer aswell as to :attr:
~aiohttp.ClientResponse.content-- by :user:
bdraco.Related issues and pull requests on GitHub:
:issue:
13655, :issue:13743.Fixed pure-Python request parser not reading a body in a
HEADrequest -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13671.Fixed host-only cookie state being lost on expiration -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13674.Fixed a possible
OverflowErroron cookies and a connection not being closed properly -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13677.The first-request deadline now also closes connections whose first request body stalls, while a body that is still arriving extends the deadline instead of being interrupted -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13681.Fixed idle connections not being closed if no request was received -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13681.Fixed :meth:
~aiohttp.web.Application.add_domainnot routing a request toits domain application when the
Hostheader carried a port and thedomain was registered without one, or, for a wildcard domain, uppercase
letters -- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
13693.Added empty
__slots__toAbstractRouteDefso thatRouteDefandStaticDefinstances no longer carry an unused__dict__.Related issues and pull requests on GitHub:
:issue:
13716.Fixed
BaseConnector(keepalive_timeout=None)crashing on the second request to the same host withTypeError: '<=' not supported between instances of 'float' and 'NoneType'-- by :user:ishan-1010.Related issues and pull requests on GitHub:
:issue:
13756, :issue:13757.Fixed a crash in :meth:
~aiohttp.BodyPartReader.read_chunkon a body partwith an explicit
Content-Length: 0: the part fell through to thestreaming read strategy, whose minimum chunk size assertion then failed for
chunk sizes below the boundary length. Such parts now yield an immediate
empty chunk, like any other part with a known length
-- by :user:
istoolsfox.Related issues and pull requests on GitHub:
:issue:
13758, :issue:13760.Fixed
Set-Cookieparsing treating unrecognized attributes as additionalcookies. Each
Set-Cookieheader now sets exactly one cookie andunrecognized attributes are ignored, per :rfc:
6265#section-5.2, preventinga malicious server from creating an attacker-selected number of cookie
objects (and correspondingly large outgoing
Cookieheaders) from abounded amount of response data.
DummyCookieJar, andCookieJarinsafe mode for IP-address origins, no longer parse
Set-Cookieheaders atall -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
13800.Fixed the web server trusting the scheme of an absolute-form r
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.