CVE-2026-34514

EUVD-2026-18037
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
HTTP Request/Response Splitting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 24.12%
Affected Products (NVD)
VendorProductVersion
aiohttpaiohttp
𝑥
< 3.13.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-aiohttp
bookworm
no-dsa
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
3.7.4-1+deb11u2
fixed
forky
3.14.1-4
fixed
sid
3.14.1-4
fixed
trixie
no-dsa
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-aiohttp
bionic
Fixed 3.0.1-1ubuntu0.1~esm7
released
focal
Fixed 3.6.2-1ubuntu1+esm6
released
jammy
Fixed 3.8.1-4ubuntu0.2+esm3
released
noble
Fixed 3.9.1-1ubuntu0.1+esm3
released
questing
ignored
resolute
Fixed 3.13.3-3ubuntu1+esm1
released
xenial
ignored
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
python3-aiohttp
suse enterprise sap 15 SP4
3.6.0-150100.3.35.1
fixed
suse enterprise server 15 SP4
3.6.0-150100.3.35.1
fixed
python311-aiohttp
suse enterprise sap 15 SP4
3.9.3-150400.10.43.1
fixed
suse enterprise server 15 SP4
3.9.3-150400.10.43.1
fixed
Common Weakness Enumeration
References
https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06
https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2vrm-gr82-f7m5