CVE-2026-34517: AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS
Analyzed
AliasesGHSA-3wq7-rqq7-wx6jPYSEC-2026-2099UBUNTU-CVE-2026-34517DEBIAN-CVE-2026-34517CGA-2w3c-p7cp-vfr9CGA-386v-3phj-c9grCGA-39pp-j4wg-7687CGA-5qx6-vxjw-m7jvCGA-6724-vq96-9vpfCGA-87rx-vr9x-43rrCGA-c923-3gqw-8qprCGA-crhj-pw8h-vm2rCGA-frr2-22fq-5w77CGA-hmqc-fqqg-j57rCGA-j5f7-rmqj-xf2qCGA-j9wr-xg54-2pmwCGA-jgjx-7756-5m74CGA-q887-6cfx-555mCGA-qq45-hgvw-xm96CGA-vx3j-gwrg-957mCGA-w5vq-f3mf-5vpqCGA-2454-pvwv-4849CGA-3whq-w43m-684fCGA-3wrh-r8g6-cjm4CGA-3x3g-hff9-f9g7CGA-4fhq-wpwp-xw56CGA-4fj8-m95c-h8prCGA-4v7q-xp63-qcf9CGA-556c-4qp3-pmxhCGA-55fv-jrg2-2m64CGA-5hhw-5xxr-88p9CGA-5wm6-8cpp-g7c4CGA-6363-m4xr-7wppCGA-76mr-pffm-5wv7CGA-7j5v-x4w8-f5ghCGA-7m2g-46rp-9cwvCGA-84pq-g3j9-2ghxCGA-8639-4p3v-c8w9CGA-88j2-jq74-9qcqCGA-8jqq-rm46-xxw3CGA-8x92-whjf-j2vqCGA-92c6-6799-mvvfCGA-956g-37h6-p26wCGA-c2rm-jf2r-43gjCGA-cj4g-2xgg-v6hwCGA-fc7f-jg7c-mq5mCGA-gv3m-9m43-cg6xCGA-h4mx-jf2r-ghp8CGA-hm57-m3q2-w7phCGA-j3cw-v988-fwxxCGA-j8cg-p5fq-77gwCGA-jrcr-7w25-m52jCGA-pg45-wj57-4r8hCGA-pqx2-34p3-7g4fCGA-qm2j-q8x3-c63gCGA-qqwx-pfc9-rjm9CGA-qxgx-pf29-rmxqCGA-r5jf-gpm8-5cwhCGA-rr84-hv56-63q5CGA-rrjm-7pqw-gxwvCGA-rv7g-qf63-66jrCGA-v27v-pwmq-54j5CGA-v98g-wmpc-3h8wCGA-xg5m-j478-cvxrALPINE-CVE-2026-34517
Published 01-04-2026Last modified 23-06-2026
Vulnerability summary
CVE-2026-34517 is a medium (CVSS 5.3) vulnerability in aio-libs aiohttp. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 34.1% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 2.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
0.40%
0%100%
Low · -0.11 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 01-04-2026PublishedVulnerability first disclosed.
- 23-06-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.
CVSS metrics
10 scores · 8 sources · 2 versionsLow 2.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:USources5 sources · 2.7–6.9
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST2.7LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 5 agree
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
Decrease -0.11 pp
From 0.51% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard26 products
- airflow-2< 2.11.2-r5
- airflow-3< 3.2.1-r0 | < 3.1.8-r11
- airflow-core-2< 2.11.2-r3
- authentik-2025.12< 2025.12.4-r3
- authentik-2026.2< 2026.2.1-r3
Wolfi7 products
- airflow-3< 3.2.1-r0 | < 3.1.8-r11
- checkov< 3.2.517-r0
- dask-kubernetes< 2026.3.0-r3
- kserve-storage-controller< 0.17.0-r2
- kubeflow-pipelines-visualization-server< 2.16.0-r4
Aio-libs1 product
- aiohttp< 3.13.4
Aiohttp1 product
- aiohttp< 3.13.4
Alpine1 product
- py3-aiohttp< 3.13.5-r0
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.8.4-1+deb12u2 | < 3.13.5-1
PyPI1 product
- aiohttp< 3.13.4
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded)
8 vendors · 39 products
References
10 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-3wq7-rqq7-wx6jX Refsource CONFIRMWEBFIXREPORTAdvisoryPatchVendor Advisory
- github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145X Refsource MISCWEBFIXREPORTPatch
- github.com/aio-libs/aiohttpPACKAGE
