HarborGuard / CVE
Back to search
CRITICALCVE-2026-34520Published Modified CNA GitHub_M

CVE-2026-34520: AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

Metrics

CVSS v3.1
9.1
Severity
CRITICAL
Fixed in
—
Affected Products
1
Affected packages
  • aio-libs / aiohttp
    < 3.13.4
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
References