CVE-2026-34517

AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34525

AIOHTTP: Duplicate Host header accepted

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34513

AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34993

AIOHTTP Vulnerable to Deserialization of Untrusted Data

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp Redhat

Products

Aiohttp Aiohttp Openshift Ai

CVE-2025-69223

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aio-libs Project Aiohttp

Products

Aiohttp Session Aiohttp Aio-libs and 1 more

CVE-2023-49082

aiohttp's ClientSession is vulnerable to CRLF injection via method

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Aiohttp Redhat

Products

Aiohttp Ansible Automation Platform Rhui and 2 more

CVE-2023-49081

aiohttp's ClientSession is vulnerable to CRLF injection via version

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Aiohttp Redhat

Products

Aiohttp Ansible Automation Platform Rhui and 2 more

CVE-2026-54278

AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54277

AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54276

AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-50269

AIOHTTP: CRLF injection in multipart headers

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54279

AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54274

AIOHTTP: Incomplete websocket frame payloads bypass memory limits

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54275

AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54280

AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54273

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-47265

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34518

AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34519

AIOHTTP: HTTP response splitting via \r in reason phrase

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34520

AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp