PT-2026-29604 · Aiohttp+1 · Aiohttp+1

Nvn1729 · CVE-2026-34515 · Published 2026-02-22 · Updated 2026-07-09

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4

Description Prior to version 3.13.4, on Windows, the static resource handler in AIOHTTP may expose information about a NTLMv2 remote path. This could potentially allow an attacker to extract the hash from an NTLMv2 path and then extract user credentials.

Recommendations Update AIOHTTP to version 3.13.4 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-36

CWE-918

Related Identifiers

BDU:2026-09573

CLEANSTART-2026-AN27706

CLEANSTART-2026-AZ09261

CLEANSTART-2026-CQ05396

CLEANSTART-2026-FU07345

CLEANSTART-2026-KE11953

CLEANSTART-2026-MR94452

CLEANSTART-2026-NM83456

CLEANSTART-2026-QE89118

CLEANSTART-2026-SO50412

CLEANSTART-2026-WQ85001

CLEANSTART-2026-WU03167

CVE-2026-34515

GHSA-P998-JP59-783M

PYSEC-2026-2097

Affected Products

Aiohttp

Red Os

References · 281

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34515.json · Exploit
• https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d · Patch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44307 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-52303 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34513 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-CQ05396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69230 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27448 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48525 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27205 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-69229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4539 · Security Note