https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T15:41:35.219250+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-34516 CVE-2026-34516 — AIOHTTP: Multipart Header Size Bypass 2026-09-28T15:41:36.124574+00:00

Affected: aio-libs aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.

 https://vulnerability.circl.lu/vuln/ghsa-m5qp-6w8w-w647 GHSA-m5qp-6w8w-w647 — AIOHTTP has a Multipart Header Size Bypass 2026-09-28T15:41:36.124680+00:00

Affected: PyPI: aiohttp

### Summary

A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.

### Impact

Multipart headers were not subject to the same size restrictions in place for normal headers, potentially allowing substantially more data to be loaded into memory than intended. However, other restrictions in place limit the impact of this vulnerability.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f

 https://vulnerability.circl.lu/vuln/pysec-2026-2098 PYSEC-2026-2098 2026-09-28T15:41:36.124741+00:00

Affected: PyPI: aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.