AIOHTTP has HTTP response splitting via \r in reason phrase

MEDIUM 5.3CVE-2026-34519 · GHSA-mwh4-6h8g-pg8w · PYSEC-2026-2101 · Published 01/04/2026 · updated 26/10/2026

Package	Affected versions	Patched versions
aiohttp PyPI	`< 3.13.4`	`3.13.4`
aiohttp aiohttp	`< 3.13.4`	`3.13.4`

Description

Summary

An attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits.

Impact

In the unlikely situation that an application allows untrusted data to be used in the response's reason parameter, then an attacker could manipulate the response to send something different from what the developer intended.

Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

References

aio-libs/aiohttp security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-34519 · ADVISORY
aio-libs/aiohttp commit 53b35a2 · WEB
aio-libs/aiohttp · PACKAGE
aio-libs/aiohttp release v3.13.4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free