Every CVE Search/ Get API key

CVE-2026-50269

AIOHTTP: CRLF injection in multipart headers

2.7 LowFix available

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.53%Up 0.5 points since Jun 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.7

AIOHTTP: CRLF injection in multipart headers

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

Record
CVE-2026-50269
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-93, CWE-113
Updated
2026-11-02
EUVDEUVD-2026-38308 2.7

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

Record
EUVD-2026-38308
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
GitHub AdvisoriesGHSA-m6qw-4cw2-hm4m 2.7

aiohttp: CRLF injection in multipart headers

Summary

Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.

Impact

In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request.

Workaround

Sanitise such user input.

Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8

Record
GHSA-m6qw-4cw2-hm4m
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-93, CWE-113
Updated
2026-11-02
NVD 2.7

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

Record
CVE-2026-50269
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-93, CWE-113
Updated
2026-11-02
OSV 2.7

AIOHTTP: CRLF injection in multipart headers

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

Record
CVE-2026-50269
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-113, CWE-93
Updated
2026-11-02
OSVDEBIAN-CVE-2026-50269 7.5

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

Record
DEBIAN-CVE-2026-50269
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 14 moreShow less
OSVGHSA-m6qw-4cw2-hm4m 2.7

aiohttp: CRLF injection in multipart headers

Summary

Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.

Impact

In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request.

Workaround

Sanitise such user input.

Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8

Record
GHSA-m6qw-4cw2-hm4m
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-113, CWE-93
Updated
2026-11-02
OSVPYSEC-2026-2106 7.5

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

Record
PYSEC-2026-2106
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-50269 2.7

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

Record
UBUNTU-CVE-2026-50269
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-90656 No score

CVE-2026-50269 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

Record
AZL-90656
Updated
2026-11-05
OSVCLSA-2026-1784769519 No score

TuxCare security update for aiohttp (6 CVEs)

TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.6.post7+tuxcare.

Record
CLSA-2026-1784769519
Updated
2026-11-02
OSVCLSA-2026-1791372571 No score

TuxCare security update for aiohttp (5 CVEs)

TuxCare rebuilt aiohttp to address 5 CVEs. Fixed in 3.8.5.post18+tuxcare.

Record
CLSA-2026-1791372571
Updated
2026-11-02
OSVCLSA-2026-1791373745 No score

TuxCare security update for aiohttp (5 CVEs)

TuxCare rebuilt aiohttp to address 5 CVEs. Fixed in 3.8.4.post14+tuxcare.

Record
CLSA-2026-1791373745
Updated
2026-11-02
OSVCLSA-2026-1791377424 No score

TuxCare security update for aiohttp (7 CVEs)

TuxCare rebuilt aiohttp to address 7 CVEs. Fixed in 3.8.1.post16+tuxcare.

Record
CLSA-2026-1791377424
Updated
2026-11-02
OSVopenSUSE-SU-2026:11097-1 No score

python311-aiohttp-3.14.1-1.1 on GA media

These are all security issues fixed in the python311-aiohttp-3.14.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11097-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21372-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues

  • CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398).
  • CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543).
  • CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544).
  • CVE-2026-54275: server_hostname TLS SNI check bypass when an existing connection is reused (bsc#1268549).
  • CVE-2026-54277: max_line_size bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556).
  • CVE-2026-54278: unread compressed request bodies can bypass client_max_size during cleanup and cause a DoS (bsc#1268559).
  • CVE-2026-54279: host-only cookies become domain cookies after CookieJar persistence (bsc#1268560).
  • CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).
Record
openSUSE-SU-2026:21372-1
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-50269 No score

CVE-2026-50269 in aiohttp - Patched by Root

Root has patched CVE-2026-50269 in the aiohttp package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-50269
Updated
2026-11-02
OSVSUSE-SU-2026:22819-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues

  • CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398).
  • CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543).
  • CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544).
  • CVE-2026-54275: server_hostname TLS SNI check bypass when an existing connection is reused (bsc#1268549).
  • CVE-2026-54277: max_line_size bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556).
  • CVE-2026-54278: unread compressed request bodies can bypass client_max_size during cleanup and cause a DoS (bsc#1268559).
  • CVE-2026-54279: host-only cookies become domain cookies after CookieJar persistence (bsc#1268560).
  • CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).
Record
SUSE-SU-2026:22819-1
Updated
2026-11-02
OSVSUSE-SU-2026:3207-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues

  • CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service (bsc#1261320).
  • CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321).
  • CVE-2026-34514: content_type parameter manipulation can lead to header injection (bsc#1261322).
  • CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of service (bsc#1261329).
  • CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service (bsc#1261331).
  • CVE-2026-34518: retained Cookie and Proxy-Authorization headers when following redirects can lead to information disclosure (bsc#1261332).
  • CVE-2026-34519: response reason parameter can be use to perform header injection (bsc#1261334).
  • CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).
  • CVE-2026-34525: multiple Host headers allow for potential security bypass in proxy servers (bsc#1261343).
  • CVE-2026-34993: loading untrusted input in CookieJar.load() can lead to arbitrary code execution (bsc#1267471).
  • CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect and can leak sensitive data (bsc#1267561).
  • CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398).
  • CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543).
  • CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544).
  • CVE-2026-54275: server_hostname TLS SNI check bypass when an existing connection is reused (bsc#1268549).
  • CVE-2026-54277: max_line_size bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556).
  • CVE-2026-54278: unread compressed request bodies can bypass client_max_size during cleanup and cause a DoS (bsc#1268559).
  • CVE-2026-54279: host-only cookies become domain cookies after CookieJar persistence (bsc#1268560).
  • CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).
Record
SUSE-SU-2026:3207-1
Updated
2026-11-02
OSVSUSE-SU-2026:3208-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues:

  • CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398).
  • CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543).
  • CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544).
  • CVE-2026-54275: server_hostname TLS SNI check bypass when an existing connection is reused (bsc#1268549).
  • CVE-2026-54277: max_line_size bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556).
  • CVE-2026-54278: unread compressed request bodies can bypass client_max_size during cleanup and cause a DoS (bsc#1268559).
  • CVE-2026-54279: host-only cookies become domain cookies after CookieJar persistence (bsc#1268560).
  • CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).
Record
SUSE-SU-2026:3208-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aiohttp
PyPI
 through 3.13.5
3.14.0
python-aiohttp
Azure Linux:3
 through 3.6.2-3 None known
aiohttp
TuxCare:PyPI
From an advisory covering 6 CVEs
 3.8.6 up to 3.8.6.post7+tuxcare, plus listed versions
3.8.6.post1+tuxcare3.8.6.post2+tuxcare3.8.6.post3+tuxcare3.8.6.post4+tuxcare3.8.6.post5+tuxcare3.8.6.post6+tuxcare
3.8.6.post7+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 5 CVEs
 3.8.5 up to 3.8.5.post18+tuxcare, plus listed versions
3.8.5.post1+tuxcare3.8.5.post10+tuxcare3.8.5.post11+tuxcare3.8.5.post12+tuxcare3.8.5.post13+tuxcare
Show 12 moreShow less
3.8.5.post14+tuxcare3.8.5.post15+tuxcare3.8.5.post16+tuxcare3.8.5.post17+tuxcare3.8.5.post2+tuxcare3.8.5.post3+tuxcare3.8.5.post4+tuxcare3.8.5.post5+tuxcare3.8.5.post6+tuxcare3.8.5.post7+tuxcare3.8.5.post8+tuxcare3.8.5.post9+tuxcare
3.8.5.post18+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 5 CVEs
 3.8.4 up to 3.8.4.post14+tuxcare, plus listed versions
3.8.4.post1+tuxcare3.8.4.post10+tuxcare3.8.4.post11+tuxcare3.8.4.post12+tuxcare3.8.4.post13+tuxcare
Show 8 moreShow less
3.8.4.post2+tuxcare3.8.4.post3+tuxcare3.8.4.post4+tuxcare3.8.4.post5+tuxcare3.8.4.post6+tuxcare3.8.4.post7+tuxcare3.8.4.post8+tuxcare3.8.4.post9+tuxcare
3.8.4.post14+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 7 CVEs
 3.8.1 up to 3.8.1.post16+tuxcare, plus listed versions
3.8.1.post1+tuxcare3.8.1.post10+tuxcare3.8.1.post11+tuxcare3.8.1.post12+tuxcare3.8.1.post13+tuxcare
Show 10 moreShow less
3.8.1.post14+tuxcare3.8.1.post15+tuxcare3.8.1.post2+tuxcare3.8.1.post3+tuxcare3.8.1.post4+tuxcare3.8.1.post5+tuxcare3.8.1.post6+tuxcare3.8.1.post7+tuxcare3.8.1.post8+tuxcare3.8.1.post9+tuxcare
3.8.1.post16+tuxcare
python-aiohttp
Debian:12
 before 3.8.4-1+deb12u2, plus listed versions
3.8.4-13.8.4-1+deb12u1
3.8.4-1+deb12u2
python-aiohttp
Debian:13
 All versions, plus listed versions
3.11.16-13.11.16-1+deb13u13.12.15-13.13.0-13.13.1-1
Show 11 moreShow less
3.13.3-13.13.3-23.13.3-33.13.5-13.14.0-13.14.1-13.14.1-23.14.1-33.14.1-43.14.1-53.14.3-1
 None known
python-aiohttp
Debian:14
 before 3.14.0-1, plus listed versions
3.11.16-13.12.15-13.13.0-13.13.1-13.13.3-13.13.3-23.13.3-33.13.5-1
3.14.0-1
aiohttp
PyPI
 before 3.14.0, plus listed versions
0.10.10.00.10.10.10.20.11.0
Show 45 moreShow less
0.12.00.13.00.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.15.30.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.10.18.20.18.30.18.40.19.00.20.20.00.20.10.20.20.21.00.21.10.21.20.21.40.21.50.21.60.22.00.22.0a00.22.0b00.22.0b10.22.0b2
3.14.0
Show 29 moreShow less
Affected packages
PackageAffectedFixed
aiohttp
Root:PyPI
 before 3.12.15+aikido.6
3.12.15+aikido.63.8.6+aikido.23.8.6+aikido.33.10.11+aikido.83.12.14+aikido.43.13.5+aikido.23.13.3+aikido.113.13.4+aikido.23.8.6+aikido.43.12.14+aikido.53.8.6+aikido.53.8.6+aikido.63.8.6+aikido.73.8.6+aikido.83.8.6+aikido.93.12.14+aikido.63.13.5+aikido.33.8.6+aikido.103.13.3+aikido.123.13.4+aikido.33.10.11+aikido.93.13.3+aikido.133.13.4+aikido.43.8.6+aikido.113.12.14+aikido.73.8.6+aikido.123.13.5+aikido.43.8.6+aikido.133.13.3+aikido.143.12.14+aikido.83.13.4+aikido.53.12.15+aikido.73.10.11+aikido.103.13.3+aikido.153.13.4+aikido.63.12.15+aikido.83.13.5+aikido.53.10.11+aikido.113.10.11+aikido.123.8.6+aikido.143.12.15+aikido.93.12.14+aikido.93.13.5+aikido.63.13.3+aikido.163.13.4+aikido.73.8.6+aikido.15
python-aiohttp
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 3.11.16-160000.6.1
3.11.16-160000.6.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 3.11.16-160000.6.1
3.11.16-160000.6.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Module for Python 3 15 SP7
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 8 CVEs
 before 3.6.0-150100.3.38.1
3.6.0-150100.3.38.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 8 CVEs
 before 3.6.0-150100.3.38.1
3.6.0-150100.3.38.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 8 CVEs
 before 3.6.0-150100.3.38.1
3.6.0-150100.3.38.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 8 CVEs
 before 3.6.0-150100.3.38.1
3.6.0-150100.3.38.1
python-aiohttp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.17.2-10.17.4-10.17.4-1build10.20.2-10.20.2-1ubuntu0.1~esm1
 None known
python-aiohttp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.3-1build12.2.3-22.3.6-13.0.1-13.0.1-1ubuntu0.1~esm1
Show 4 moreShow less
3.0.1-1ubuntu0.1~esm43.0.1-1ubuntu0.1~esm53.0.1-1ubuntu0.1~esm63.0.1-1ubuntu0.1~esm7
 None known
python-aiohttp
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.5.4-13.5.4-1build13.6.1-13.6.2-13.6.2-1build1
Show 7 moreShow less
3.6.2-1ubuntu0.1~esm13.6.2-1ubuntu13.6.2-1ubuntu1+esm13.6.2-1ubuntu1+esm33.6.2-1ubuntu1+esm43.6.2-1ubuntu1+esm53.6.2-1ubuntu1+esm6
 None known
python-aiohttp
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.7.4-13.7.4-1build23.8.1-33.8.1-43.8.1-4build1
Show 4 moreShow less
3.8.1-4ubuntu0.23.8.1-4ubuntu0.2+esm13.8.1-4ubuntu0.2+esm23.8.1-4ubuntu0.2+esm3
 None known
python-aiohttp
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.8.4-13.9.1-13.9.1-1build13.9.1-1ubuntu0.13.9.1-1ubuntu0.1+esm13.9.1-1ubuntu0.1+esm23.9.1-1ubuntu0.1+esm3
 None known
python-aiohttp
Ubuntu:25.10
 All versions, plus listed versions
3.10.11-1build13.11.16-13.11.16-1ubuntu0.1
 None known
python-aiohttp
Ubuntu:26.10
 All versions, plus listed versions
3.13.3-3ubuntu13.14.1-43.14.1-53.14.3-1
 None known
python-aiohttp
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
3.11.16-13.13.1-13.13.3-33.13.3-3ubuntu13.13.3-3ubuntu1+esm1
 None known
python-aiohttp
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 3.14.1-1.1
3.14.1-1.1
python-aiohttp
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 3.11.16-160000.6.1
3.11.16-160000.6.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-50269 is a low vulnerability (CVSS 2.7) in Aio-libs Aiohttp, published June 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in aiohttp 3.14.0.

References

Show 44 moreShow less
This page doesn't list everything

Left out here: 256 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open