AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
### Summary On Windows the static resource handler may expose information about a NTLMv2 remote path. ### Impact If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there. ----- Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-34515US | high7.5 | — | ||
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/aio-libs/aiohttpPACKAGE
- https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3dWEB
- https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4WEB
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783mWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-34515ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan