PT-2026-29606 · Aiohttp · Aiohttp

Bekkaze · Published 2026-04-01 · Updated 2026-05-18 · CVE-2026-34517

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4

Description Prior to version 3.13.4, AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, read the entire multipart form field into memory before checking the client max size limit. This could allow an attacker to cause significant temporary memory allocation even if the request is ultimately rejected.

Recommendations Update to version 3.13.4 or later.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CLEANSTART-2026-AN27706

CVE-2026-34517

ECHO-185F-C78C-4E82

GHSA-3WQ7-RQQ7-WX6J

OESA-2026-2192

OESA-2026-2193

OESA-2026-2194

Affected Products

Aiohttp

References · 62

• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3wq7-rqq7-wx6j · Vendor Advisory
• https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34514 · Security Note
• https://ubuntu.com/security/CVE-2026-34517 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30922 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-34517 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34517 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44431 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44432 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33175 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34519 · Security Note