AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

HIGH 7.5CVE-2026-34515 · GHSA-p998-jp59-783m · PYSEC-2026-2097 · Published 01/04/2026 · updated 26/10/2026

Package	Affected versions	Patched versions
aiohttp PyPI	`< 3.13.4`	`3.13.4`
aiohttp aiohttp	`< 3.13.4`	`3.13.4`

Description

Summary

On Windows the static resource handler may expose information about a NTLMv2 remote path.

Impact

If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.

Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.

References

aio-libs/aiohttp security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-34515 · ADVISORY
aio-libs/aiohttp commit 0ae2aa0 · WEB
aio-libs/aiohttp · PACKAGE
aio-libs/aiohttp release v3.13.4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free