CVE-2026-34516: AIOHTTP: Multipart Header Size Bypass
Analyzed
AliasesGHSA-m5qp-6w8w-w647PYSEC-2026-2098UBUNTU-CVE-2026-34516DEBIAN-CVE-2026-34516CGA-2m47-x6wq-pp9jCGA-2wxr-3xr6-gg78CGA-3jjx-hh6f-mc28CGA-485h-2wqv-8p77CGA-4qc4-449w-w796CGA-58fh-3xx3-4m5cCGA-7m3x-6w8m-c6r8CGA-7mw8-x8wh-pq39CGA-8wwj-r9xj-p997CGA-926x-f8c9-7vgpCGA-g334-xq2q-ccfvCGA-j95q-6v4p-ccrwCGA-mmw2-8rwp-fxwpCGA-mw2h-7fwf-vp3mCGA-rrx3-99ch-f645CGA-w7cp-92f3-8qq7CGA-xg5m-pc98-j7c9CGA-2679-8p56-qjvmCGA-2w9m-j5xq-h96mCGA-336q-2hc2-w64hCGA-38hh-xmqc-g8grCGA-393p-jfcc-5pf7CGA-4j37-xfpg-xw93CGA-4m7x-f583-7p9fCGA-5w5j-m5v8-pwpmCGA-6mgx-9c62-f4w3CGA-85ff-2rf4-w9ppCGA-8fhq-88rg-9m5mCGA-8pww-8vrc-xc2gCGA-8q4j-3crf-4vq8CGA-98rj-h65f-95v8CGA-9wcv-2vgq-5q6fCGA-chv5-9jh3-jr3wCGA-cjwq-p9p8-xppvCGA-cmwj-wr2m-f82wCGA-f5xx-p4mp-mf9vCGA-f7jh-4vh7-88g9CGA-g2qw-9mc6-2424CGA-g4m8-3p85-4pm3CGA-hjv3-5hw3-q249CGA-j4h6-7fq6-ff62CGA-m99m-p57q-95r4CGA-p276-2rhp-c58vCGA-pcvw-g43w-5gg9CGA-pgwx-8xq4-m949CGA-q5qh-8366-mj63CGA-q672-f56v-h75gCGA-qfrp-992h-6mjfCGA-r2wp-6pf9-77wrCGA-rg2m-9263-vpmfCGA-rpf4-qjw3-pfr8CGA-v27h-999j-9mv5CGA-v4m4-9c7w-43jjCGA-v8rw-c59h-h3q4CGA-v9xq-g36j-f56gCGA-wmf2-gqg2-v7hfCGA-wv23-c955-98x2CGA-wv4c-8gw2-5rqcCGA-x5jq-q5gh-59pqCGA-xv7w-g9cm-7g87ALPINE-CVE-2026-34516
Published 01-04-2026Last modified 04-04-2026
Vulnerability summary
CVE-2026-34516 is a high (CVSS 7.5) vulnerability in aio-libs aiohttp. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39.7% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 6.6, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.46%
0%100%
Low · -0.15 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 7Timeline
- 01-04-2026PublishedVulnerability first disclosed.
- 04-04-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.
CVSS metrics
11 scores · 8 sources · 2 versionsMedium 6.6Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:USources8 sources · 6.6–8.7
- OSV · PypiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · DebianEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST6.6MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · AlpineEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
Decrease -0.15 pp
From 0.61% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard26 products
- airflow-2< 2.11.2-r5
- airflow-3< 3.1.8-r11 | < 3.2.1-r0
- airflow-core-2< 2.11.2-r3
- authentik-2025.12< 2025.12.4-r3
- authentik-2026.2< 2026.2.1-r3
Wolfi7 products
- airflow-3< 3.1.8-r11 | < 3.2.1-r0
- checkov< 3.2.517-r0
- dask-kubernetes< 2026.3.0-r3
- kserve-storage-controller< 0.17.0-r2
- kubeflow-pipelines-visualization-server< 2.16.0-r4
Aio-libs1 product
- aiohttp< 3.13.4
Aiohttp1 product
- aiohttp< 3.13.4
Alpine1 product
- py3-aiohttp< 3.13.5-r0
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.8.4-1+deb12u2 | < 3.13.5-1
PyPI1 product
- aiohttp< 3.13.4
Ubuntu1 product
- python-aiohttp< 0.20.2-1ubuntu0.1~esm1 | < 3.0.1-1ubuntu0.1~esm7 | < 3.8.1-4ubuntu0.2+esm3 | < 3.9.1-1ubuntu0.1+esm3 | All versions (No fix recorded) | < 3.13.3-3ubuntu1+esm1
8 vendors · 39 products
References
11 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-m5qp-6w8w-w647X Refsource CONFIRMWEBFIXREPORTAdvisoryPatchVendor Advisory
- github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6fX Refsource MISCWEBFIXREPORTPatch
- github.com/aio-libs/aiohttpPACKAGE
