CVE-2026-34520

EUVD-2026-18046
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.
HTTP Request/Response Splitting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 37.97%
Affected Products (NVD)
VendorProductVersion
aiohttpaiohttp
𝑥
< 3.13.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-aiohttp
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
3.7.4-1+deb11u2
fixed
forky
3.14.1-4
fixed
sid
3.14.1-4
fixed
trixie
no-dsa
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-aiohttp
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
ignored
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
python3-aiohttp
suse enterprise sap 15 SP4
3.6.0-150100.3.35.1
fixed
suse enterprise server 15 SP4
3.6.0-150100.3.35.1
fixed
python311-aiohttp
suse enterprise sap 15 SP4
3.9.3-150400.10.43.1
fixed
suse enterprise server 15 SP4
3.9.3-150400.10.43.1
fixed
Common Weakness Enumeration
References
https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4
https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqf