-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aiohttp | pip | < 3.8.0 | 3.8.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper header validation in HTTP/1.1 parsing. The commit diff shows critical changes in the parse_headers function where a new check was added to raise BadHttpMessage when both headers are present. The pre-patch version only checked for 'chunked' in Transfer-Encoding without validating header exclusivity, creating an inconsistency between aiohttp's parsing and proxy servers' interpretation. This matches the CWE-444 description of HTTP request smuggling through header inconsistency.