CVE-2026-34519: aio-libs aiohttp HTTP Request/Response Splitting
CVSS: 5.3v3.1MediumAnalyzed
AliasesGHSA-mwh4-6h8g-pg8wPYSEC-2026-2101UBUNTU-CVE-2026-34519DEBIAN-CVE-2026-34519CGA-23fg-qp7x-rqwpCGA-2c8w-5gvc-mf64CGA-2gx9-x95q-q3f2CGA-392p-68mm-6h3vCGA-522g-p5qg-7m92CGA-5gxr-m984-c3qgCGA-6w95-c242-vhg2CGA-8xp5-qf6x-vjxwCGA-j6wv-xxrf-ff5jCGA-jvp3-vvjc-6wfcCGA-m4j5-m55g-4vq3CGA-p26m-pxfr-2wcrCGA-p3mm-88mh-5phmCGA-rcmm-x7wc-cxxcCGA-v4rh-wv23-jpg2CGA-v637-wjgg-rrwrCGA-x94j-hr43-5cc5CGA-286w-jm68-99xpCGA-28r6-xrwh-g292CGA-2j63-f4g9-685wCGA-3gwf-p8vf-mw7mCGA-4258-w3jp-222fCGA-45w5-7jvf-7xh9CGA-46h5-gqwg-3j62CGA-546h-chmp-45chCGA-58hm-f4h3-jf2jCGA-5gcc-qgm8-22p6CGA-5w3x-5fx7-6qfgCGA-623x-843x-rm6wCGA-692f-vwx3-vvgmCGA-6jw9-7j99-hqcjCGA-6w95-37w8-rmxqCGA-6xx5-74gv-7pgcCGA-792r-75jh-5c69CGA-7q5v-7jqq-4498CGA-7rx6-9xg5-7c4cCGA-9x72-xg93-7h8qCGA-cfhm-27qf-3729CGA-fjvx-r649-52j2CGA-fpjp-9vfm-r3h7CGA-g8h9-gwgh-m3gjCGA-g9g3-8pgw-f2pqCGA-gjfg-7gxx-rm8fCGA-gq4w-p565-56jpCGA-gqh2-5v7c-44qxCGA-gvcc-hhxr-v7mfCGA-hq5m-j85g-73vxCGA-j9ch-vfmc-3643CGA-jxv2-2rpg-7v9gCGA-mqv2-qq6x-gpprCGA-qc22-8gg9-mwqmCGA-r624-wx6c-h776CGA-rq6r-2w5c-5pq3CGA-rwhx-j4wr-8jj8CGA-v622-m7gv-qc4vCGA-v7pc-58x8-77qqCGA-vcw3-82q7-2xr8CGA-vpwm-5xpj-4r8xCGA-wvpx-9w59-w5c5CGA-x478-8479-24vj
Published 01-04-2026Last modified 02-04-2026
Vulnerability summary
CVE-2026-34519 is a medium (CVSS 5.3) HTTP Request/Response Splitting vulnerability in aio-libs aiohttp. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.6% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
0.40%
0%100%
Low · +0.11 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 01-04-2026PublishedVulnerability first disclosed.
- 02-04-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
CVSS metrics
9 scores · 7 sources · 2 versionsLow 2.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:USources5 sources · 2.7–6.9
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST2.7LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
+0.11 pp
From 0.29% on 20-09-2026
20-09-202620-10-2026
EPSS score0.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard26 products
- airflow-2< 2.11.2-r5
- airflow-3< 3.1.8-r11 | < 3.2.1-r0
- airflow-core-2< 2.11.2-r3
- authentik-2025.12< 2025.12.4-r3
- authentik-2026.2< 2026.2.1-r3
Wolfi7 products
- airflow-3< 3.1.8-r11 | < 3.2.1-r0
- checkov< 3.2.517-r0
- dask-kubernetes< 2026.3.0-r3
- kserve-storage-controller< 0.17.0-r2
- kubeflow-pipelines-visualization-server< 2.16.0-r4
Aio-libs1 product
- aiohttp< 3.13.4
Aiohttp1 product
- aiohttp< 3.13.4
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.13.5-1
PyPI1 product
- aiohttp< 3.13.4
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded)
7 vendors · 38 products
References
9 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8wX Refsource CONFIRMWEBFIXREPORTAdvisoryPatchVendor Advisory
- github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2bX Refsource MISCWEBFIXREPORTPatch
- github.com/aio-libs/aiohttpPACKAGE
