CVE-2026-50269

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.0

Description Attacker-controlled input included in multipart/payload headers can be used to modify a request to inject additional headers or change the request contents. This occurs when an application passes user-controlled strings into the MultipartWriter.append(headers=...) function or the Payload.headers variable.

Recommendations Update to version 3.14.0. Sanitize user input passed into multipart/payload headers.