https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 12:29:15 +0000 https://vulnerability.circl.lu/vuln/cve-2026-34519 <p><strong>Affected:</strong> aio-libs aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.</p> <p><strong>Affected:</strong> aio-libs aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.</p> https://vulnerability.circl.lu/vuln/cve-2026-34519 https://vulnerability.circl.lu/vuln/ghsa-mwh4-6h8g-pg8w <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>An attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.</p> <p>### Impact</p> <p>In the unlikely situation that an application allows untrusted data to be used in the response&#39;s `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>An attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.</p> <p>### Impact</p> <p>In the unlikely situation that an application allows untrusted data to be used in the response&#39;s `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b</p> https://vulnerability.circl.lu/vuln/ghsa-mwh4-6h8g-pg8w https://vulnerability.circl.lu/vuln/pysec-2026-2101 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.</p> https://vulnerability.circl.lu/vuln/pysec-2026-2101