CVE-2026-34519
published 2026-04-01CVE-2026-34519: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.29%
21.4th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.13.4 | 3.13.4 |
| aiohttp | aiohttp | < 3.13.4 | 3.13.4 |
| aiohttp | aiohttp | >= 0 < 3.13.4 | 3.13.4 |
| debian | python-aiohttp | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.02.7LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv2.7LOW
vendor_debian2.7LOW
vendor_redhat2.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
AIOHTTP has HTTP response splitting via \r in reason phrase
osv·2026-04-01
CVE-2026-34519 [LOW] AIOHTTP has HTTP response splitting via \r in reason phrase
AIOHTTP has HTTP response splitting via \r in reason phrase
### Summary
An attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.
### Impact
In the unlikely situation that an application allows untrusted data to be used in the response's `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.
Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b
OSV
CVE-2026-34519: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
osv·2026-04-01·CVSS 2.7
CVE-2026-34519 [LOW] CVE-2026-34519: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
GHSA
AIOHTTP has HTTP response splitting via \r in reason phrase
ghsa·2026-04-01
CVE-2026-34519 [LOW] CWE-113 AIOHTTP has HTTP response splitting via \r in reason phrase
AIOHTTP has HTTP response splitting via \r in reason phrase
### Summary
An attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.
### Impact
In the unlikely situation that an application allows untrusted data to be used in the response's `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.
Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b
Red Hat
aiohttp: aiohttp: Header injection vulnerability via reason parameter
vendor_redhat·2026-04-01·CVSS 2.7
CVE-2026-34519 [LOW] CWE-1286 aiohttp: aiohttp: Header injection vulnerability via reason parameter
aiohttp: aiohttp: Header injection vulnerability via reason parameter
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. A remote attacker could exploit this vulnerability by controlling the 'reason' parameter during the creation of an HTTP response. This could allow the attacker to inject additional HTTP headers, potentially leading to unexpected behavior or further exploitation.
Mitigation: Mitigation for this issue is either not available or the currently available options d
Debian
CVE-2026-34519: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
vendor_debian·2026·CVSS 2.7
CVE-2026-34519 [LOW] CVE-2026-34519: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-34519 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 2.7
CVE-2026-34519 [LOW] CVE-2026-34519 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34519 :
Wolfi vulnerability analysis and mitigation
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Source : NVD
## 2.7
Score
Published April 1, 2026
Severity LOW
CNA Score 2.7
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 18.3
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
python-aiohttp
checkov
Sources
NVD
Chainguard Has Fix Added at: Apr 02, 2026
Debian 11, 12, 13, 14 No Fi
Bugzilla
CVE-2026-34519 aiohttp: aiohttp: Header injection vulnerability via reason parameter
bugzilla·2026-04-01·CVSS 2.7
CVE-2026-34519 [LOW] CVE-2026-34519 aiohttp: aiohttp: Header injection vulnerability via reason parameter
CVE-2026-34519 aiohttp: aiohttp: Header injection vulnerability via reason parameter
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
2026-04-01
Published