CVE-2026-34514
HTTP Header Injection Vulnerability in AIOHTTP Before
Publication date: 2026-04-01
Last updated on: 2026-04-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| aiohttp | aiohttp | to 3.13.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-113 | The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade aiohttp to version 3.13.4 or later, where the issue has been patched.
Can you explain this vulnerability to me?
This vulnerability exists in the AIOHTTP framework, which is an asynchronous HTTP client/server framework for asyncio and Python. Before version 3.13.4, an attacker who could control the content_type parameter in aiohttp could exploit this to inject extra HTTP headers or perform similar attacks.
The issue was fixed in version 3.13.4 of aiohttp.
How can this vulnerability impact me? :
If an attacker can control the content_type parameter, they may be able to inject additional HTTP headers or carry out similar exploits. This could potentially lead to unexpected behavior in the application, such as security bypasses or manipulation of HTTP requests and responses.