AIOHTTP Patches Multiple Vulnerabilities in Version 3.13.4

AIOHTTP incorrectly accepts multiple Host headers in a request. This could allow an attacker to bypass security checks on reverse proxies that rely on the Host header for routing or access control.

AIOHTTP is vulnerable to HTTP response splitting if the `reason` parameter of a `Response` object is controlled by an attacker. By injecting carriage return characters, an attacker can inject arbitrary headers into the response.

AIOHTTP reads the entire multipart form field into memory before checking `client_max_size`. An attacker can exploit this by sending a large multipart request, causing excessive memory allocation and a potential denial-of-service.

AIOHTTP retains the Cookie and Proxy-Authorization headers when following redirects to a different origin. This can lead to sensitive information being leaked to an unintended party.

AIOHTTP's unbounded DNS cache can lead to excessive memory usage, potentially resulting in a denial-of-service. An application making requests to a large number of hosts could exhaust memory resources.

On Windows, AIOHTTP's static resource handler may expose information about a NTLMv2 remote path, potentially leading to credential theft or local file read.

AIOHTTP is vulnerable to CRLF injection through the multipart part content type header construction. An attacker who controls the `content_type` parameter can inject extra headers or similar exploits.