https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T10:47:02.016343+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-34514 CVE-2026-34514 — AIOHTTP: CRLF injection in multipart part content type header construction 2026-09-29T10:47:02.123186+00:00

Affected: aio-libs aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

 https://vulnerability.circl.lu/vuln/ghsa-2vrm-gr82-f7m5 GHSA-2vrm-gr82-f7m5 — AIOHTTP has CRLF injection through multipart part content type header construction 2026-09-29T10:47:02.123297+00:00

Affected: PyPI: aiohttp

### Summary

An attacker who controls the `content_type` parameter in aiohttp could use this to inject extra headers or similar exploits.

### Impact

If an application allows untrusted data to be used for the multipart `content_type` parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06

 https://vulnerability.circl.lu/vuln/pysec-2026-2096 PYSEC-2026-2096 2026-09-29T10:47:02.123362+00:00

Affected: PyPI: aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.