HTTP Header Injection Vulnerability in AIOHTTP Response Component

Publication date: 2026-04-01

Last updated on: 2026-04-16

Assigner: GitHub, Inc.

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-01

Last Modified

2026-04-16

Generated

2026-07-06

AI Q&A

2026-04-02

EPSS Evaluated

2026-07-05

NVD

CVE-2026-34519

Affected Vendors & Products

Vendor	Product	Version / Range
aiohttp	aiohttp	to 3.13.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-113	The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the AIOHTTP framework prior to version 3.13.4. It allows an attacker who controls the 'reason' parameter when creating a Response to potentially inject extra HTTP headers or perform similar exploits.

Impact Analysis

The vulnerability can allow an attacker to inject additional HTTP headers into responses. This could lead to security issues such as header injection attacks, which might be used to manipulate client behavior, bypass security controls, or conduct other malicious activities.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade AIOHTTP to version 3.13.4 or later, where the issue has been patched.

Hi! I’m here to help you understand CVE-2026-34519. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70