Most recent entries from all

CVE-2026-34514 — AIOHTTP: CRLF injection in multipart part content type header construction

Affected: aio-libs aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

GHSA-2vrm-gr82-f7m5 — AIOHTTP has CRLF injection through multipart part content type header construction

Affected: PyPI: aiohttp

### Summary

An attacker who controls the `content_type` parameter in aiohttp could use this to inject extra headers or similar exploits.

### Impact

If an application allows untrusted data to be used for the multipart `content_type` parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06

PYSEC-2026-2096

Affected: PyPI: aiohttp