CVE-2026-34514
published 2026-04-01CVE-2026-34514: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.32%
23.8th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.13.4 | 3.13.4 |
| aiohttp | aiohttp | < 3.13.4 | 3.13.4 |
| aiohttp | aiohttp | >= 0 < 3.13.4 | 3.13.4 |
| debian | python-aiohttp | — | — |
| ubuntu | python-aiohttp | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.02.7LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv2.7LOW
vendor_ubuntu7.5HIGH
vendor_debian2.7LOW
vendor_redhat2.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
AIOHTTP vulnerabilities
vendor_ubuntu·2026-07-22·CVSS 7.5
CVE-2026-34513 [HIGH] AIOHTTP vulnerabilities
Title: AIOHTTP vulnerabilities
Summary: Several security issues were fixed in AIOHTTP.
Sean Gilligan discovered that AIOHTTP did not properly limit memory
usage when processing HTTP headers and trailers. An attacker could
possibly use this issue to consume excessive system resources, resulting
in a denial of service. (CVE-2026-22815)
It was discovered that AIOHTTP did not properly limit the size of its
DNS cache. An attacker could possibly use this issue to consume
excessive system resources, resulting in a denial of service.
(CVE-2026-34513)
Mingi Jung discovered that AIOHTTP did not properly sanitize the
content_type parameter. An attacker could possibly use this issue to
inject malicious HTTP headers, resulting in HTTP response splitting.
(CVE-2026-34514)
It was discovered that AIO
Red Hat
aiohttp: AIOHTTP: Header Injection via content_type parameter manipulation
vendor_redhat·2026-04-01·CVSS 2.7
CVE-2026-34514 [LOW] CWE-93 aiohttp: AIOHTTP: Header Injection via content_type parameter manipulation
aiohttp: AIOHTTP: Header Injection via content_type parameter manipulation
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. A remote attacker, by manipulating the `content_type` parameter, could inject additional HTTP headers. This could lead to unexpected behavior or bypass certain security measures within applications utilizing the framework.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produ
Debian
CVE-2026-34514: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
vendor_debian·2026·CVSS 2.7
CVE-2026-34514 [LOW] CVE-2026-34514: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
GHSA
AIOHTTP has CRLF injection through multipart part content type header construction
ghsa·2026-04-01
CVE-2026-34514 [LOW] CWE-113 AIOHTTP has CRLF injection through multipart part content type header construction
AIOHTTP has CRLF injection through multipart part content type header construction
### Summary
An attacker who controls the `content_type` parameter in aiohttp could use this to inject extra headers or similar exploits.
### Impact
If an application allows untrusted data to be used for the multipart `content_type` parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.
Patch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06
OSV
CVE-2026-34514: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
osv·2026-04-01·CVSS 2.7
CVE-2026-34514 [LOW] CVE-2026-34514: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
OSV
AIOHTTP has CRLF injection through multipart part content type header construction
osv·2026-04-01
CVE-2026-34514 [LOW] AIOHTTP has CRLF injection through multipart part content type header construction
AIOHTTP has CRLF injection through multipart part content type header construction
### Summary
An attacker who controls the `content_type` parameter in aiohttp could use this to inject extra headers or similar exploits.
### Impact
If an application allows untrusted data to be used for the multipart `content_type` parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.
Patch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-34514 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 2.7
CVE-2026-34514 [LOW] CVE-2026-34514 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34514 :
Wolfi vulnerability analysis and mitigation
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Source : NVD
## 2.7
Score
Published April 1, 2026
Severity LOW
CNA Score 2.7
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 18.3
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
python-aiohttp
checkov
Sources
NVD
Chainguard Has Fix Added at: Apr 02, 2026
Debian 11, 12, 13, 14 No Fix Add
Bugzilla
CVE-2026-34514 aiohttp: AIOHTTP: Header Injection via content_type parameter manipulation
bugzilla·2026-04-01·CVSS 2.7
CVE-2026-34514 [LOW] CVE-2026-34514 aiohttp: AIOHTTP: Header Injection via content_type parameter manipulation
CVE-2026-34514 aiohttp: AIOHTTP: Header Injection via content_type parameter manipulation
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
2026-04-01
Published