PT-2026-29608 · Aiohttp · Aiohttp

Dhiral2908 · Published 2026-04-01 · Updated 2026-05-18 · CVE-2026-34519

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4

Description AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. An attacker controlling the reason parameter when creating a Response may inject extra headers or similar exploits. This could allow manipulation of the response to send unintended data if untrusted data is used in the reason parameter.

Recommendations Update to version 3.13.4 or later.

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CLEANSTART-2026-AN27706

CVE-2026-34519

ECHO-ABE8-B546-AD42

GHSA-MWH4-6H8G-PG8W

OESA-2026-2192

OESA-2026-2193

OESA-2026-2194

Affected Products

Aiohttp

References · 62

• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8w · Vendor Advisory
• https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34514 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30922 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44432 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34052 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34520 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-AN27706 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34519 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22815 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31958 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2192 · Vendor Advisory