CVE-2026-34515
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
- Record
CVE-2026-34515- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-36, CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2026-18039
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
- Record
EUVD-2026-18039- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p998-jp59-783m
AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
Summary
On Windows the static resource handler may expose information about a NTLMv2 remote path.
Impact
If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.
Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
- Record
GHSA-p998-jp59-783m- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-36, CWE-918
- Updated
- 2026-11-02
NVD
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
- Record
CVE-2026-34515- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-36, CWE-918
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-34515
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
- Record
ALPINE-CVE-2026-34515- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
- Record
CVE-2026-34515- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-36, CWE-918
- Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-p998-jp59-783m
AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
Summary
On Windows the static resource handler may expose information about a NTLMv2 remote path.
Impact
If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.
Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
- Record
GHSA-p998-jp59-783m- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-36, CWE-918
- Updated
- 2026-11-02
OSVPYSEC-2026-2097
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
- Record
PYSEC-2026-2097- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2026-34515
CVE-2026-34515 in aiohttp - Patched by Root
Root has patched CVE-2026-34515 in the aiohttp package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2026-34515- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-34515
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
- Record
UBUNTU-CVE-2026-34515- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVAZL-81764 No score
CVE-2026-34515 affecting package python-aiohttp 3.6.2-3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
- Record
AZL-81764- Updated
- 2026-11-05
OSVCLSA-2026-1780361391 No score
TuxCare security update for aiohttp (4 CVEs)
TuxCare rebuilt aiohttp to address 4 CVEs. Fixed in 3.8.4.post4+tuxcare.
- Record
CLSA-2026-1780361391- Updated
- 2026-11-02
OSVCLSA-2026-1789467837 No score
TuxCare security update for aiohttp (2 CVEs)
TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.6.post13+tuxcare.
- Record
CLSA-2026-1789467837- Updated
- 2026-11-02
OSVCLSA-2026-1790748996 No score
TuxCare security update for aiohttp (2 CVEs)
TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.1.post15+tuxcare.
- Record
CLSA-2026-1790748996- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aiohttpPyPI |
through 3.13.3 | 3.13.4 |
py3-aiohttpAlpine:v3.23 |
before 3.13.5-r0 | 3.13.5-r0 |
py3-aiohttpAlpine:v3.24 |
before 3.13.5-r0 | 3.13.5-r0 |
python-aiohttpAzure Linux:3 |
through 3.6.2-3 | None known |
aiohttpTuxCare:PyPI From an advisory covering 4 CVEs |
3.8.4 up to 3.8.4.post4+tuxcare, plus listed versions 3.8.4.post1+tuxcare3.8.4.post2+tuxcare3.8.4.post3+tuxcare |
3.8.4.post4+tuxcare |
aiohttpTuxCare:PyPI From an advisory covering 2 CVEs |
3.8.6 up to 3.8.6.post13+tuxcare, plus listed versions 3.8.6.post1+tuxcare3.8.6.post10+tuxcare3.8.6.post11+tuxcare3.8.6.post12+tuxcare3.8.6.post2+tuxcare Show 7 moreShow less3.8.6.post3+tuxcare3.8.6.post4+tuxcare3.8.6.post5+tuxcare3.8.6.post6+tuxcare3.8.6.post7+tuxcare3.8.6.post8+tuxcare3.8.6.post9+tuxcare |
3.8.6.post13+tuxcare |
aiohttpTuxCare:PyPI From an advisory covering 2 CVEs |
3.8.1 up to 3.8.1.post15+tuxcare, plus listed versions 3.8.1.post1+tuxcare3.8.1.post10+tuxcare3.8.1.post11+tuxcare3.8.1.post12+tuxcare3.8.1.post13+tuxcare Show 9 moreShow less3.8.1.post14+tuxcare3.8.1.post2+tuxcare3.8.1.post3+tuxcare3.8.1.post4+tuxcare3.8.1.post5+tuxcare3.8.1.post6+tuxcare3.8.1.post7+tuxcare3.8.1.post8+tuxcare3.8.1.post9+tuxcare |
3.8.1.post15+tuxcare |
aiohttpPyPI |
before 3.13.4, plus listed versions 0.10.10.00.10.10.10.20.11.0 Show 45 moreShow less0.12.00.13.00.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.15.30.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.10.18.20.18.30.18.40.19.00.20.20.00.20.10.20.20.21.00.21.10.21.20.21.40.21.50.21.60.22.00.22.0a00.22.0b00.22.0b10.22.0b2 |
3.13.4 |
aiohttpRoot:PyPI |
before 3.13.3+aikido.10 | 3.13.3+aikido.103.10.11+aikido.33.12.15+aikido.23.10.11+aikido.43.8.6+aikido.13.10.11+aikido.53.12.15+aikido.33.10.11+aikido.63.10.11+aikido.73.12.14+aikido.33.12.15+aikido.43.12.15+aikido.53.12.15+aikido.63.8.6+aikido.23.8.6+aikido.33.10.11+aikido.83.12.14+aikido.43.13.3+aikido.113.8.6+aikido.43.12.14+aikido.53.8.6+aikido.53.8.6+aikido.63.8.6+aikido.73.8.6+aikido.83.8.6+aikido.93.12.14+aikido.63.8.6+aikido.103.13.3+aikido.123.10.11+aikido.93.13.3+aikido.133.8.6+aikido.113.12.14+aikido.73.8.6+aikido.123.8.6+aikido.133.13.3+aikido.143.12.14+aikido.83.12.15+aikido.73.10.11+aikido.103.9.5+aikido.63.13.3+aikido.153.12.15+aikido.83.10.11+aikido.113.10.11+aikido.123.8.6+aikido.143.9.5+aikido.73.12.15+aikido.93.12.14+aikido.93.13.3+aikido.163.8.6+aikido.15 |
python-aiohttpUbuntu:25.10 |
All versions, plus listed versions 3.10.11-1build13.11.16-13.11.16-1ubuntu0.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34515 is a medium vulnerability (CVSS 6.6) in Aio-libs Aiohttp, published April 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in aiohttp 3.13.4.
References
github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m
nvd.nist.gov/vuln/detail/CVE-2026-34515
security.alpinelinux.org/vuln/CVE-2026-34515
Left out here: 254 versions. The JSON record has them.