CVE-2026-34514: AIOHTTP: CRLF injection in multipart part content type header construction
Summary
An attacker who controls the contenttype parameter in aiohttp could use this to inject extra headers or similar exploits.
Impact
If an application allows untrusted data to be used for the multipart contenttype parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the contenttype parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.13.4 - Upgrade
Upgrade
debian/python-aiohttpto a version that resolves this vulnerability.Fixed in 3.7.4-1+deb11u2Fixed in 3.14.1-4 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.13.4Patch 9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06