CVE-2026-34514: AIOHTTP: CRLF injection in multipart part content type header construction
Analyzed
AliasesGHSA-2vrm-gr82-f7m5PYSEC-2026-2096UBUNTU-CVE-2026-34514DEBIAN-CVE-2026-34514CGA-29pj-g63x-9f4rCGA-2jp8-cp2h-vffgCGA-46mc-8hq8-7jjfCGA-72h2-jv7g-9m6vCGA-7g46-fw76-9wg3CGA-9cqw-73xx-5g44CGA-9gwq-52hj-rr3qCGA-9w9f-94xv-456jCGA-9x63-6qqw-fvvfCGA-ccvw-jr58-3c52CGA-f3gg-c25g-4g96CGA-jqcc-ww57-v697CGA-r2qr-cv57-rg57CGA-vqcx-fv55-q935CGA-vrmp-xqh7-33hmCGA-w4pj-cw3q-8mffCGA-w822-9rvj-qj9hopenSUSE-SU-2026:10490-1CGA-27jg-g77c-gw9fCGA-2h2q-jvhx-qcg6CGA-2qgg-crx4-763jCGA-32gp-4vcw-4pxcCGA-36wr-8fm4-mr9mCGA-3fjj-46gj-qh5xCGA-3fmv-gc6x-q669CGA-3p69-73pp-7v7gCGA-3qjr-gp7x-45qpCGA-4jm3-w5qp-5gj5CGA-4pr4-7x34-8gjvCGA-533x-974f-g73cCGA-69vr-rcv7-v9v7CGA-6j76-j226-jxgpCGA-6jh2-w84m-w8f2CGA-7pvq-hfr8-7f2vCGA-7v86-98rh-7728CGA-8rj3-p9w2-gppjCGA-95rm-hvv2-96h2CGA-9p96-c7v3-6c8fCGA-9pv6-629f-v955CGA-c6w8-h8q4-7p9gCGA-cwp2-rxj4-2h57CGA-cwpm-w68v-v45hCGA-g6xq-j7mw-3366CGA-g77x-fmhp-h874CGA-gr3f-7mvp-pmjqCGA-gw74-jv3g-q4r6CGA-h83q-77q9-vrggCGA-hjrq-c2fh-m4rwCGA-hmxg-j9gv-qv3cCGA-hp9v-qfx3-gggrCGA-mj8g-f8hw-g57hCGA-p9qw-hqc4-f9pgCGA-pjvm-gqwg-x44gCGA-px62-3m23-jjqfCGA-qj59-x56j-cgj6CGA-qpv7-5733-7q7wCGA-qrp4-r388-rqqmCGA-r6x4-3hg6-w856CGA-rjx3-qqfq-mpm2CGA-vwcq-g673-p6wrCGA-wqrx-h399-rv7fALPINE-CVE-2026-34514
Published 01-04-2026Last modified 02-04-2026
Vulnerability summary
CVE-2026-34514 is a medium (CVSS 5.3) vulnerability in aio-libs aiohttp. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.8% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 2.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
0.33%
0%100%
Low · -0.07 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 6Timeline
- 01-04-2026PublishedVulnerability first disclosed.
- 02-04-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
CVSS metrics
10 scores · 8 sources · 2 versionsLow 2.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:USources5 sources · 2.7–6.9
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST2.7LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NSourcesAll 5 agree
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
Decrease -0.07 pp
From 0.40% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard26 products
- airflow-2< 2.11.2-r5
- airflow-3< 3.1.8-r11 | < 3.2.1-r0
- airflow-core-2< 2.11.2-r3
- authentik-2025.12< 2025.12.4-r3
- authentik-2026.2< 2026.2.1-r3
Wolfi7 products
- airflow-3< 3.1.8-r11 | < 3.2.1-r0
- checkov< 3.2.517-r0
- dask-kubernetes< 2026.3.0-r3
- kserve-storage-controller< 0.17.0-r2
- kubeflow-pipelines-visualization-server< 2.16.0-r4
Aio-libs1 product
- aiohttp< 3.13.4
Aiohttp1 product
- aiohttp< 3.13.4
Alpine1 product
- py3-aiohttp< 3.13.5-r0
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.8.4-1+deb12u2 | < 3.13.5-1
Opensuse1 product
- python-aiohttp&distro=openSUSE Tumbleweed< 3.13.5-2.1
PyPI1 product
- aiohttp< 3.13.4
Ubuntu1 product
- python-aiohttp< 0.20.2-1ubuntu0.1~esm1 | < 3.0.1-1ubuntu0.1~esm7 | < 3.8.1-4ubuntu0.2+esm3 | < 3.9.1-1ubuntu0.1+esm3 | All versions (No fix recorded) | < 3.13.3-3ubuntu1+esm1
9 vendors · 40 products
References
12 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-2vrm-gr82-f7m5X Refsource CONFIRMWEBFIXREPORTAdvisoryPatchVendor Advisory
- github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06X Refsource MISCWEBFIXREPORTPatch
- github.com/aio-libs/aiohttpPACKAGE
