CVE-2026-34515

EUVD-2026-18039
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.92%
Affected Products (NVD)
VendorProductVersion
aiohttpaiohttp
𝑥
< 3.13.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-aiohttp
bookworm
3.8.4-1+deb12u1
fixed
bookworm (security)
3.8.4-1+deb12u1
fixed
bullseye
3.7.4-1
fixed
bullseye (security)
3.7.4-1+deb11u2
fixed
forky
3.14.1-4
fixed
sid
3.14.1-4
fixed
trixie
3.11.16-1+deb13u1
fixed
trixie (security)
3.11.16-1+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-aiohttp
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
questing
ignored
resolute
not-affected
xenial
ignored
Common Weakness Enumeration
References
https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m