AIKIDO-2026-81574
aiosonic is vulnerable to HTTP Header Injection
54
Medium Risk
This Affects:
aiosonicTL;DR
aiosonic serializes outbound HTTP/1.1 request headers by interpolating caller-supplied header names and values directly into the request bytes with no validation of either token. When an application places attacker-influenced input into a header value, carriage-return/line-feed sequences reach the wire unmodified, allowing injection of arbitrary additional headers and even a complete second pipelined request on the same connection. This enables header injection, request splitting/smuggling, cache poisoning, and SSRF-style requests to upstream-reachable paths. The fix adds an http_parser.validate_header() check that rejects illegal header tokens and CR/LF characters, enforced in add_header() and the WebSocket handshake.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application places attacker-influenced input into an outbound request header name or value.
Background info
aiosonic is vulnerable to HTTP Header Injection in versions 0.0.1 - 1.0.2.
How to fix this
Upgrade the aiosonic library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant