CVE-2026-34520

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4

Description The C parser, used by default in most installations, allowed null bytes and control characters within response headers. An attacker could leverage this to send header values that are interpreted unexpectedly due to the presence of control characters. For example, request.url.origin() might return a different value than the raw Host header, potentially leading to a security bypass.

Recommendations Update to version 3.13.4 or later.