PT-2026-29609 · Aiohttp · Aiohttp

Oxqnd + 1 · Published 2026-04-01 · Updated 2026-05-18 · CVE-2026-34520

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4

Description The C parser, used by default in most installations, allowed null bytes and control characters within response headers. An attacker could leverage this to send header values that are interpreted unexpectedly due to the presence of control characters. For example, request.url.origin() might return a different value than the raw Host header, potentially leading to a security bypass.

Recommendations Update to version 3.13.4 or later.

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CLEANSTART-2026-AN27706

CVE-2026-34520

ECHO-9E39-7166-9C17

GHSA-63HF-3VF5-4WQF

OESA-2026-2192

OESA-2026-2193

OESA-2026-2194

OPENSUSE-SU-2026:10545-1

Affected Products

Aiohttp

References · 64

• https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4 · Patch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqf · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34514 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34520 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34520 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30922 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34517 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44431 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34073 · Security Note
• https://osv.dev/vulnerability/GHSA-63hf-3vf5-4wqf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44432 · Security Note