buildroot ▾
›
2025.02.x ▾
›
vulnerability
›
CVE-2026-34525
Component Overview
Vulnerability Overview
Name
CVE-2026-34525
Source
NVD (
link
)
Debian (
link
)
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
CWEs
CWE-20
Published Date
Apr 1, 2026
Updated Date
Jun 17, 2026
Workaround
-
Advisories
https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000
Patch
https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349
Patch
https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4
Release Notes
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-c427-h43c-vf67
Patch
Analysis
#
Affected Component
Analysis
python-aiohttp
Exploitable
Vulnerability Ratings
#
6.3
CVSSv4
5.3
CVSSv31
NaN
other
Others affected component
#
Name
Project
Project Version
Version
Status
python-aiohttp
buildroot
master
3.13.5
Not Affected