PT-2026-29608

CVE-2026-34519

·

Published

2026-03-07

·

Updated

2026-10-06

Description by

CVSS 3.1
5.3
Medium
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4
Description AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. An attacker controlling the reason parameter when creating a Response may inject extra headers or similar exploits. This could allow manipulation of the response to send unintended data if untrusted data is used in the reason parameter.
Recommendations Update to version 3.13.4 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\'HTTP Request/Response Splitting\')
Related identifiers
CVE-2026-34519
BDU:2026-09577
GHSA-MWH4-6H8G-PG8W
AZL-81776
CLEANSTART-2026-AN24336
CLEANSTART-2026-AN27706
CLEANSTART-2026-AZ09261
CLEANSTART-2026-CQ05396
CLEANSTART-2026-EM82280
CLEANSTART-2026-FU07345
CLEANSTART-2026-HP19968
CLEANSTART-2026-IR98353
CLEANSTART-2026-KE11953
CLEANSTART-2026-MR94452
CLEANSTART-2026-NL78203
CLEANSTART-2026-NM83456
CLEANSTART-2026-QE89118
CLEANSTART-2026-SO50412
CLEANSTART-2026-UK00522
CLEANSTART-2026-WQ85001
CLEANSTART-2026-WU03167
ECHO-ABE8-B546-AD42
OESA-2026-2192
OESA-2026-2193
OESA-2026-2194
OPENSUSE-SU-2026:21098-1
PYSEC-2026-2101
SUSE-SU-2026:22173-1
SUSE-SU-2026:3059-1
SUSE-SU-2026:3207-1
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com