CVE-2024-23829

aiohttp is an asynchronous HTTP client/server framework for asyncio and
Python. Security-sensitive parts of the Python HTTP parser retained minor
differences in allowable character sets, that must trigger error handling
to robustly match frame boundaries of proxies in order to protect against
injection of additional requests. Additionally, validation could trigger
exceptions that were not handled consistently with processing of other
malformed input. Being more lenient than internet standards require could,
depending on deployment environment, assist in request smuggling. The
unhandled exception could cause excessive resource consumption on the
application server and/or its logging facilities. This vulnerability exists
due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this
vulnerability.

Notes