PT-2026-29604 · Aiohttp · Aiohttp

Nvn1729 · Published 2026-04-01 · Updated 2026-05-18 · CVE-2026-34515

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4

Description Prior to version 3.13.4, on Windows, the static resource handler in AIOHTTP may expose information about a NTLMv2 remote path. This could potentially allow an attacker to extract the hash from an NTLMv2 path and then extract user credentials.

Recommendations Update AIOHTTP to version 3.13.4 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

CWE-36

Related Identifiers

CLEANSTART-2026-AN27706

CVE-2026-34515

GHSA-P998-JP59-783M

Affected Products

Aiohttp

References · 53

• https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d · Patch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34515 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-30922 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34517 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44431 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44432 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33175 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34520 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34052 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34519 · Security Note