CVE-2026-34525
published 2026-04-01CVE-2026-34525: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.29%
20.8th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.13.4 | 3.13.4 |
| aiohttp | aiohttp | < 3.13.4 | 3.13.4 |
| aiohttp | aiohttp | >= 0 < 3.13.4 | 3.13.4 |
| debian | python-aiohttp | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.3MEDIUM
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
aiohttp: aiohttp: Security bypass via multiple Host headers
vendor_redhat·2026-04-01·CVSS 6.3
CVE-2026-34525 [MEDIUM] CWE-444 aiohttp: aiohttp: Security bypass via multiple Host headers
aiohttp: aiohttp: Security bypass via multiple Host headers
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. This vulnerability allows a remote attacker to send multiple Host headers in a single request. This can lead to unexpected behavior, potentially bypassing security controls or causing cache poisoning, which may result in integrity issues.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread
Debian
CVE-2026-34525: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
vendor_debian·2026·CVSS 6.3
CVE-2026-34525 [MEDIUM] CVE-2026-34525: python-aiohttp - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. ...
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
GHSA
AIOHTTP accepts duplicate Host headers
ghsa·2026-04-01
CVE-2026-34525 [MEDIUM] CWE-20 AIOHTTP accepts duplicate Host headers
AIOHTTP accepts duplicate Host headers
### Summary
Multiple Host headers were allowed in aiohttp.
### Impact
Mostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using `Application.add_domain()`.
Patch: https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349
Patch: https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000
OSV
CVE-2026-34525: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
osv·2026-04-01·CVSS 6.3
CVE-2026-34525 [MEDIUM] CVE-2026-34525: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
OSV
AIOHTTP accepts duplicate Host headers
osv·2026-04-01
CVE-2026-34525 [MEDIUM] AIOHTTP accepts duplicate Host headers
AIOHTTP accepts duplicate Host headers
### Summary
Multiple Host headers were allowed in aiohttp.
### Impact
Mostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using `Application.add_domain()`.
Patch: https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349
Patch: https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-34525 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2026-34525 [MEDIUM] CVE-2026-34525 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34525 :
Wolfi vulnerability analysis and mitigation
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
Source : NVD
## 6.3
Score
Published April 1, 2026
Severity MEDIUM
CNA Score 6.3
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 27.7
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
python-aiohttp
checkov
Sources
NVD
Chainguard Has Fix Added at: Apr 02, 2026
Debian 11, 12, 13, 14 No Fix Added at: Apr 02, 2026
Echo Has Fix Added at: Apr 02, 2026
pip Severity ME
Bugzilla
CVE-2026-34525 aiohttp: aiohttp: Security bypass via multiple Host headers
bugzilla·2026-04-01·CVSS 6.3
CVE-2026-34525 [MEDIUM] CVE-2026-34525 aiohttp: aiohttp: Security bypass via multiple Host headers
CVE-2026-34525 aiohttp: aiohttp: Security bypass via multiple Host headers
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
2026-04-01
Published