AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4 Patch
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqf Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 2.7 · aiohttpNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*