CVE-2026-34519

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-113

Affected software

Vendor	Product	Versions
aio-libs	aiohttp	< 3.13.4

References

https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2bPatch
https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4Release Notes
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8wPatch, Vendor Advisory

Timeline

Published: Apr 1, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-34527.2Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via CVE-2026-345209.1AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most CVE-2026-345228.1SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-345235.3SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-345248.8SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-345255.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed CVE-2026-345265.0SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-345275.3Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, SbieIniServer::HashPassword c CVE-2026-345289.8File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-345299.0File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-34538.1The ProfilePress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.16.11. This CVE-2026-345306.9File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri