PYSEC-2026-2096

vendorUSosv

view advisory published 2026-04-01Licence: CC-BY-4.0

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-34514US	medium5.3	0.32% (24th)	—	2026-04-01
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use th…

references

External citations — patches, advisories, analysis.

https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06FIX
https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4ADVISORY
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2vrm-gr82-f7m5FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan