CVE-2026-34993
published 2026-06-02CVE-2026-34993: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may…
PriorityP342high7.3CVSS 3.1
AVLACLPRLUIRSUCHIHAH
EPSS
0.14%
3.6th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.
Affected
113 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.0 | 3.14.0 |
| aiohttp | aiohttp | < 3.14.0 | 3.14.0 |
| aiohttp | aiohttp | >= 0 < 3.14.0 | 3.14.0 |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| ansible-automation-platform-27 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
ghsa·2026-06-03
CVE-2026-34993 [MEDIUM] CWE-502 AIOHTTP is Vulnerable to Deserialization of Untrusted Data
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
### Summary
Using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution.
### Impact
Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.
### Workaround
If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading.
Patch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
VulDB
aio-libs aiohttp up to 3.13.x CookieJar.load deserialization (GHSA-jg22-mg44-37j8)
vuldb·2026-06-03·CVSS 6.4
CVE-2026-34993 [MEDIUM] aio-libs aiohttp up to 3.13.x CookieJar.load deserialization (GHSA-jg22-mg44-37j8)
A vulnerability was found in aio-libs aiohttp up to 3.13.x. It has been declared as problematic. This vulnerability affects the function CookieJar.load. The manipulation results in deserialization.
This vulnerability is reported as CVE-2026-34993. The attack requires a local approach. No exploit exists.
It is recommended to upgrade the affected component.
Red Hat
aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
vendor_redhat·2026-06-02·CVSS 7.3
CVE-2026-34993 [HIGH] CWE-502 aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This co
No detection rules found.
No public exploits indexed.
https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8https://access.redhat.com/errata/RHSA-2026:24977https://access.redhat.com/errata/RHSA-2026:34456https://access.redhat.com/errata/RHSA-2026:37275https://access.redhat.com/errata/RHSA-2026:42644https://access.redhat.com/errata/RHSA-2026:43038https://access.redhat.com/security/cve/CVE-2026-34993https://bugzilla.redhat.com/show_bug.cgi?id=2484099https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34993.json
2026-06-02
Published