CVE-2026-34515
published 2026-04-01CVE-2026-34515: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.43%
35.1th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.13.4 | 3.13.4 |
| aiohttp | aiohttp | < 3.13.4 | 3.13.4 |
| aiohttp | aiohttp | >= 0 < 3.13.4 | 3.13.4 |
| debian | python-aiohttp | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.6MEDIUM
vendor_debian6.6LOW
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
aiohttp: AIOHTTP: Information disclosure via static resource handler on Windows
vendor_redhat·2026-04-01·CVSS 6.6
CVE-2026-34515 [MEDIUM] CWE-497 aiohttp: AIOHTTP: Information disclosure via static resource handler on Windows
aiohttp: AIOHTTP: Information disclosure via static resource handler on Windows
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. On Windows systems, the static resource handler may inadvertently expose sensitive information related to a NTLMv2 remote path. This information disclosure vulnerability could allow an attacker to gain insights into the system's configuration or network environment.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Secu
Debian
CVE-2026-34515: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
vendor_debian·2026·CVSS 6.6
CVE-2026-34515 [MEDIUM] CVE-2026-34515: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
OSV
CVE-2026-34515: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
osv·2026-04-03·CVSS 6.6
CVE-2026-34515 [MEDIUM] CVE-2026-34515: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
GHSA
AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
ghsa·2026-04-01
CVE-2026-34515 [MEDIUM] CWE-36 AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
### Summary
On Windows the static resource handler may expose information about a NTLMv2 remote path.
### Impact
If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.
Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
OSV
AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
osv·2026-04-01
CVE-2026-34515 [MEDIUM] AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
### Summary
On Windows the static resource handler may expose information about a NTLMv2 remote path.
### Impact
If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.
Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-34515 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.6
CVE-2026-34515 [MEDIUM] CVE-2026-34515 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34515 :
Wolfi vulnerability analysis and mitigation
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
Source : NVD
## 6.6
Score
Published April 1, 2026
Severity MEDIUM
CNA Score 6.6
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 22.6
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
datahub-ingestion-fips
keep
Sources
NVD
Chainguard Has Fix Added at: Apr 02, 2026
pip Severity MEDIUM Has Fix Added at: Apr 02, 2026
Wolfi
Bugzilla
CVE-2026-34515 aiohttp: AIOHTTP: Information disclosure via static resource handler on Windows
bugzilla·2026-04-01·CVSS 6.6
CVE-2026-34515 [MEDIUM] CVE-2026-34515 aiohttp: AIOHTTP: Information disclosure via static resource handler on Windows
CVE-2026-34515 aiohttp: AIOHTTP: Information disclosure via static resource handler on Windows
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
2026-04-01
Published