The Fix
Upgrade to version 3.10.7 or later.
Based on closed aio-libs/aiohttp issue #9307 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -0,0 +1 @@
@@ -0,0 +1 @@
+Fixed assembling the :class:`~yarl.URL` for web requests when the host contains a non-default port or IPv6 address -- by :user:`bdraco`.
diff --git a/aiohttp/web_request.py b/aiohttp/web_request.py
index d593a75da74..b7b54fbd41d 100644
repro.py
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == "example.com"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
fix.md
Option A — Upgrade to fixed release\nUpgrade to version 3.10.7 or later.\nWhen NOT to use: Do not apply this fix if the application relies on the previous behavior of URL assembly.\n\n
Why This Fix Works in Production
- Trigger: Pinning yarl to < 1.13.0 will also prevent the issue since the validation doesn't happen until that version.
- Mechanism: Fixes the issue where the port was incorrectly passed in the host field to URL.build when the Host header included the port.
- Why the fix works: Fixes the issue where the port was incorrectly passed in the host field to URL.build when the Host header included the port. (first fixed release: 3.10.7).
Production impact:
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Triggered by an upgrade/regression window: 1.13.0 breaks; 3.10.7 is the first fixed release.
- Production symptom (often without a traceback): Pinning yarl to < 1.13.0 will also prevent the issue since the validation doesn't happen until that version.
Proof / Evidence
- GitHub issue: #9307
- Fix PR: https://github.com/aio-libs/aiohttp/pull/9309
- First fixed release: 3.10.7
- Affected versions: 1.13.0
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.70
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.47
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“Fix for Home Assistant is https://github.com/home-assistant/core/pull/126882”
“This is messy because downstream expects the port in a lot of places to get the host Its also used for X-Forwarded-Host which is also…”
“Should the yarl dependency be pinned to 1.12.1 in ~https://github.com/aio-libs/aiohttp/blob/master/requirements/runtime-deps.in#L11C1-L11C22~ https://github.com/aio-libs/aiohttp/blob/master/setup.cfg#L57 until the issue is solved?”
“I can't imagine we'll make another release without solving the issue, so updating the pin is not going to help.”
Failure Signature (Search String)
- Pinning yarl to < 1.13.0 will also prevent the issue since the validation doesn't happen until that version.
- tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
Copy-friendly signature
signature.txt
Failure Signature
-----------------
Pinning yarl to < 1.13.0 will also prevent the issue since the validation doesn't happen until that version.
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
Error Message
Signature-only (no traceback captured)
error.txt
Error Message
-------------
Pinning yarl to < 1.13.0 will also prevent the issue since the validation doesn't happen until that version.
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
Minimal Reproduction
repro.py
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
tests/components/http/test_forwarded.py: assert request.host == "example.com"
tests/components/http/test_forwarded.py: assert request.host == f"{url.host}:{url.port}"
What Broke
Requests failed to assemble the correct URL when the host contained a non-default port.
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
Upgrade to version 3.10.7 or later.
When NOT to use: Do not apply this fix if the application relies on the previous behavior of URL assembly.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/aio-libs/aiohttp/pull/9309
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- Do not apply this fix if the application relies on the previous behavior of URL assembly.
Verify Fix
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Capture the exact failing error string in logs and tests so you can reproduce via a minimal script.
- Pin production dependencies and upgrade only with a reproducible test that hits the failing path.
Version Compatibility Table
| Version | Status |
|---|---|
| 1.13.0 | Broken |
| 3.10.7 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.