CVE-2024-27306: Aiohttp

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.

Affected products

• Aiohttp Aiohttp: before 3.9.4 (fixed in 3.9.4)
• Fedoraproject Fedora: version 38 only; version 39 only; version 40 only

Published 2024-04-18. Last modified 2026-06-17.