https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 18:31:29 +0000 https://db.gcve.eu/vuln/ghsa-63hf-3vf5-4wqf <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>The C parser (the default for most installs) accepted null bytes and control characters in request headers.</p> <p>### Impact</p> <p>An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `request.url.origin()` may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>The C parser (the default for most installs) accepted null bytes and control characters in request headers.</p> <p>### Impact</p> <p>An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `request.url.origin()` may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4</p> https://db.gcve.eu/vuln/ghsa-63hf-3vf5-4wqf