PT-2026-45829 · Aio Libs · Aiohttp

Published 2026-06-02 · Updated 2026-06-02 · CVE-2026-34993

NVD

CVSS v3.1

6.4

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-34993

Affected Products

Aiohttp

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-34993 · Security Note
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8 · Note
• https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00 · Note