CVE-2026-34520

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

Summary

The C parser (the default for most installs) accepted null bytes and control characters in request headers.

Impact

An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, request.url.origin() may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.

Patch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4

Async http client/server framework (asyncio).

Security Fix(es):

Insufficient restrictions in header/trailer handling could cause uncapped memory usage.(CVE-2026-22815)

An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.(CVE-2026-34513)

An attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits.(CVE-2026-34514)

A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.(CVE-2026-34516)

For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.(CVE-2026-34517)

When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.(CVE-2026-34518)

aiohttp is vulnerable to HTTP response splitting attacks. An attacker can insert carriage return (\r) characters in the reason phrase to craft malicious responses, leading to response splitting attacks. This vulnerability affects aiohttp versions up to and including 3.13.3.(CVE-2026-34519)

The llhttp parser in aiohttp accepts null bytes and control characters in response header values, which could allow attackers to perform HTTP header injection attacks and bypass security restrictions.(CVE-2026-34520)

aiohttp is a Python asynchronous HTTP client/server framework. In version 3.13.3 and earlier, there is a security vulnerability that allows accepting duplicate Host headers, which may lead to HTTP request smuggling attacks. Attackers could exploit this vulnerability to bypass security controls or perform man-in-the-middle attacks.(CVE-2026-34525)

Async http client/server framework (asyncio).

Security Fix(es):

Insufficient restrictions in header/trailer handling could cause uncapped memory usage.(CVE-2026-22815)

An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.(CVE-2026-34513)

An attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits.(CVE-2026-34514)

A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.(CVE-2026-34516)

For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.(CVE-2026-34517)

When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.(CVE-2026-34518)

aiohttp is vulnerable to HTTP response splitting attacks. An attacker can insert carriage return (\r) characters in the reason phrase to craft malicious responses, leading to response splitting attacks. This vulnerability affects aiohttp versions up to and including 3.13.3.(CVE-2026-34519)

The llhttp parser in aiohttp accepts null bytes and control characters in response header values, which could allow attackers to perform HTTP header injection attacks and bypass security restrictions.(CVE-2026-34520)

aiohttp is a Python asynchronous HTTP client/server framework. In version 3.13.3 and earlier, there is a security vulnerability that allows accepting duplicate Host headers, which may lead to HTTP request smuggling attacks. Attackers could exploit this vulnerability to bypass security controls or perform man-in-the-middle attacks.(CVE-2026-34525)

Async http client/server framework (asyncio).

Security Fix(es):

Insufficient restrictions in header/trailer handling could cause uncapped memory usage.(CVE-2026-22815)

An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.(CVE-2026-34513)

An attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits.(CVE-2026-34514)

A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.(CVE-2026-34516)

For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.(CVE-2026-34517)

When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.(CVE-2026-34518)

aiohttp is vulnerable to HTTP response splitting attacks. An attacker can insert carriage return (\r) characters in the reason phrase to craft malicious responses, leading to response splitting attacks. This vulnerability affects aiohttp versions up to and including 3.13.3.(CVE-2026-34519)

The llhttp parser in aiohttp accepts null bytes and control characters in response header values, which could allow attackers to perform HTTP header injection attacks and bypass security restrictions.(CVE-2026-34520)

aiohttp is a Python asynchronous HTTP client/server framework. In version 3.13.3 and earlier, there is a security vulnerability that allows accepting duplicate Host headers, which may lead to HTTP request smuggling attacks. Attackers could exploit this vulnerability to bypass security controls or perform man-in-the-middle attacks.(CVE-2026-34525)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

Root has patched CVE-2026-34520 in the aiohttp package for Root:PyPI. Multiple fixed versions available.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post3+tuxcare.

TuxCare rebuilt aiohttp to address 4 CVEs. Fixed in 3.8.4.post2+tuxcare.

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post6+tuxcare.

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.1.post10+tuxcare.

These are all security issues fixed in the python311-aiohttp-3.13.5-3.1 package on the GA media of openSUSE Tumbleweed.

This update for python-aiohttp fixes the following issues

• CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
• CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
• CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
• CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
• CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
• CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).
• CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
• CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
• CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
• CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
• CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect (bsc#1267561).

This update for python-aiohttp fixes the following issues

• CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
• CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
• CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
• CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
• CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
• CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).
• CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
• CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
• CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
• CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
• CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect (bsc#1267561).

This update for python-aiohttp fixes the following issues

• CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
• CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
• CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
• CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
• CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
• CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).
• CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
• CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
• CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
• CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
• CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect (bsc#1267561).

This update for python-aiohttp fixes the following issues

• CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service (bsc#1261320).
• CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321).
• CVE-2026-34514: content_type parameter manipulation can lead to header injection (bsc#1261322).
• CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of service (bsc#1261329).
• CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service (bsc#1261331).
• CVE-2026-34518: retained Cookie and Proxy-Authorization headers when following redirects can lead to information disclosure (bsc#1261332).
• CVE-2026-34519: response reason parameter can be use to perform header injection (bsc#1261334).
• CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).
• CVE-2026-34525: multiple Host headers allow for potential security bypass in proxy servers (bsc#1261343).
• CVE-2026-34993: loading untrusted input in CookieJar.load() can lead to arbitrary code execution (bsc#1267471).
• CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect and can leak sensitive data (bsc#1267561).
• CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398).
• CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543).
• CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544).
• CVE-2026-54275: server_hostname TLS SNI check bypass when an existing connection is reused (bsc#1268549).
• CVE-2026-54277: max_line_size bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556).
• CVE-2026-54278: unread compressed request bodies can bypass client_max_size during cleanup and cause a DoS (bsc#1268559).
• CVE-2026-54279: host-only cookies become domain cookies after CookieJar persistence (bsc#1268560).
• CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).