AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000 Patch
- https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349 Patch
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-c427-h43c-vf67 Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.3 · aiohttpNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*
References 4
- https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000 Patch
- https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349 Patch
- https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4 Release Notes
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-c427-h43c-vf67 Patch, Vendor Advisory