CVE-2026-50269
published 2026-06-22CVE-2026-50269: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.30%
22.2th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.
Affected
111 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.0 | 3.14.0 |
| aiohttp | aiohttp | < 3.14.0 | 3.14.0 |
| aiohttp | aiohttp | >= 0 < 3.14.0 | 3.14.0 |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| ansible-automation-platform-27 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.02.7LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
aio-libs aiohttp up to 3.13.x crlf injection (GHSA-m6qw-4cw2-hm4m)
vuldb·2026-06-22·CVSS 2.7
CVE-2026-50269 [LOW] aio-libs aiohttp up to 3.13.x crlf injection (GHSA-m6qw-4cw2-hm4m)
A vulnerability marked as critical has been reported in aio-libs aiohttp up to 3.13.x. Affected by this issue is some unknown functionality. Performing a manipulation results in crlf injection.
This vulnerability is reported as CVE-2026-50269. The attack is possible to be carried out remotely. No exploit exists.
It is suggested to upgrade the affected component.
GHSA
aiohttp: CRLF injection in multipart headers
ghsa·2026-06-15
CVE-2026-50269 [LOW] CWE-113 aiohttp: CRLF injection in multipart headers
aiohttp: CRLF injection in multipart headers
### Summary
Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.
### Impact
In the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.
### Workaround
Sanitise such user input.
Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8
Red Hat
aiohttp: AIOHTTP: CRLF injection in multipart headers
vendor_redhat·2026-06-22·CVSS 7.5
CVE-2026-50269 [HIGH] aiohttp: AIOHTTP: CRLF injection in multipart headers
aiohttp: AIOHTTP: CRLF injection in multipart headers
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.
Statement: A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. Attacker-controlled input passed into multipart or payload headers can inject additional HTTP headers via CRLF sequences.
No detection rules found.
No public exploits indexed.
2026-06-22
Published