PYSEC-2026-2102

vendorUSosv

view advisory published 2026-04-01Licence: CC-BY-4.0

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-34520US	—	0.46% (40th)	—	2026-04-01
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and contro…

references

External citations — patches, advisories, analysis.

https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4FIX
https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4ADVISORY
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqfFIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan