Update aiohttp dependency to fix 9 security vulnerabilities (CVEs)
Open
Beginner friendly
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 2.5k
- Forks
- 319
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 133
Description
Problem
inference-sdk (latest version 0.63.5) pins aiohttp to <=3.10.11, which has 9 known CVEs:
| CVE | Severity | Description |
|---|---|---|
| CVE-2025-53643 | High | Request smuggling vulnerability |
| CVE-2025-69223 | High | Zip bomb DoS |
| CVE-2025-69224 | Medium | Request smuggling with non-ASCII |
| CVE-2025-69228 | High | Memory exhaustion |
| CVE-2025-69229 | Medium | Chunked message DoS |
| CVE-2025-69230 | Medium | Logging storm |
| CVE-2025-69226 | High | Path traversal |
| CVE-2025-69227 | Medium | Infinite loop DoS |
| CVE-2025-69225 | Low | Non-ASCII decimals in Range header |
Current constraint
aiohttp<=3.10.11,>=3.9.0
Request
Please update the aiohttp dependency to >=3.13.3 (or remove the upper bound) to allow users to fix these security vulnerabilities.
Impact
Projects using inference-sdk cannot update aiohttp to patched versions, leaving them exposed to these CVEs.
References
Thank you!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named in the issue; start by locating the inference-sdk dependency declaration containing the aiohttp constraint. Update it so aiohttp can resolve to 3.13.3 or newer, then verify dependency installation or resolution and confirm the existing constraint no longer blocks patched versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100