CVE-2026-34520: AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass
Analyzed
AliasesGHSA-63hf-3vf5-4wqfPYSEC-2026-2102UBUNTU-CVE-2026-34520DEBIAN-CVE-2026-34520CGA-23f6-fmrg-hh8pCGA-584r-x43x-vqw9CGA-692q-mc57-9559CGA-7v5j-qpwg-xc94CGA-7vhm-xjqp-x7r9CGA-cggq-8qg6-xxc3CGA-f3jr-49fr-qw24CGA-g328-r4m7-5ppxCGA-h4pv-p6hc-hj56CGA-h6p6-xj82-cjc3CGA-jf76-x4qv-qqm6CGA-m6gp-xxmh-rg92CGA-m8wp-pvpm-fv8jCGA-p39c-qj62-rpp2CGA-q8x2-xpxf-g3mqCGA-v8qg-24g7-jf9qCGA-vr9h-56fc-2ffqCGA-222q-qp78-xr97CGA-229r-x42g-9m46CGA-2p74-grwc-w8m9CGA-3p48-2x32-6gr5CGA-4332-m53g-8gc8CGA-4hxg-gvfv-9fr9CGA-5m2w-3wc6-89f8CGA-5p2f-rjg9-xx3wCGA-62g2-9xf6-rfvvCGA-6q3r-q5q5-p6rjCGA-84qv-6f26-vmgvCGA-89vq-rxhj-r64pCGA-8hr4-6gvj-5fcqCGA-9262-c7vw-m4xgCGA-9gpc-ffmw-3h3vCGA-9h8f-5q8g-h35pCGA-c88x-x3v5-6qgmCGA-cc6q-xqv2-cqwfCGA-cmvw-xwhr-9qx3CGA-cpqg-9g9g-49vmCGA-fhf9-jgwm-m7g6CGA-g3mx-6xq2-wqx6CGA-gm49-59r8-cm73CGA-gmc9-74qc-8m8pCGA-gqx7-3v2v-cmm4CGA-h5hp-p8mv-r292CGA-h7pg-w2pr-763rCGA-hh54-3r6f-vh8fCGA-jm74-xqfc-6f3mCGA-jx69-m479-gc3wCGA-mw3x-qrp3-xp2jCGA-qw6x-4vfw-8ffrCGA-r3v9-98h7-2hp2CGA-r4mf-5497-36m5CGA-rjw9-88rx-mhx2CGA-rq6h-q9xv-m68vCGA-rw6f-79g5-jhc3CGA-rw6v-7f2v-8952CGA-rw74-c8pf-58x3CGA-wg88-vrg7-w2cxCGA-wr45-4mqx-h837CGA-x9qx-x25w-8w82CGA-xp3x-2jg5-38qjALPINE-CVE-2026-34520
Published 01-04-2026Last modified 04-04-2026
Vulnerability summary
CVE-2026-34520 is a critical (CVSS 9.1) vulnerability in aio-libs aiohttp. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 2.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)EPSS score
0.48%
0%100%
Low · -0.20 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 01-04-2026PublishedVulnerability first disclosed.
- 04-04-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.
CVSS metrics
11 scores · 8 sources · 2 versionsLow 2.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:USources8 sources · 2.7–6.9
- OSV · PypiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · DebianEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST2.7LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · AlpineEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
Critical 9.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
Decrease -0.20 pp
From 0.68% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard26 products
- airflow-2< 2.11.2-r5
- airflow-3< 3.2.1-r0 | < 3.1.8-r11
- airflow-core-2< 2.11.2-r3
- authentik-2025.12< 2025.12.4-r3
- authentik-2026.2< 2026.2.1-r3
Wolfi7 products
- airflow-3< 3.2.1-r0 | < 3.1.8-r11
- checkov< 3.2.517-r0
- dask-kubernetes< 2026.3.0-r3
- kserve-storage-controller< 0.17.0-r2
- kubeflow-pipelines-visualization-server< 2.16.0-r4
Aio-libs1 product
- aiohttp< 3.13.4
Aiohttp1 product
- aiohttp< 3.13.4
Alpine1 product
- py3-aiohttp< 3.13.5-r0
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.8.4-1+deb12u2 | < 3.13.5-1
PyPI1 product
- aiohttp< 3.13.4
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded)
8 vendors · 39 products
References
11 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqfX Refsource CONFIRMWEBFIXREPORTAdvisoryPatchVendor Advisory
- github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4X Refsource MISCWEBFIXREPORTPatch
- github.com/aio-libs/aiohttpPACKAGE
