~ / search / GHSA-2vrm-gr82-f7m5

GHSA-2vrm-gr82-f7m5

AIOHTTP has CRLF injection through multipart part content type header construction

Source: GitHub Advisory Database (reviewed) Low CVE-2026-34514

Packages

EcosystemPackageAffectedFixed in
PyPI aiohttp < 3.13.4 3.13.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary An attacker who controls the `content_type` parameter in aiohttp could use this to inject extra headers or similar exploits. ### Impact If an application allows untrusted data to be used for the multipart `content_type` parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended. ----- Patch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06

References

External links from the advisory. They lead to third-party sites.