Vulnerability - CVE-2026-34520

›

›vulnerability›CVE-2026-34520

Name

CVE-2026-34520

Source

NVD ( link)Debian ( link)

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

CWEs

Published Date

Apr 1, 2026

Updated Date

Jun 17, 2026

Workaround

-

Advisories

https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4Patch

https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4Release Notes

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqfPatch

Analysis#

Affected Component

Analysis

Vulnerability Ratings#

2.7

CVSSv4

9.1

CVSSv31

NaN

other

Others affected component#

Name

Project

Project Version

Version

Status

buildroot

master

3.13.5

Not Affected