GitHub Advisoryadvisory · PyPI

GHSA-63hf-3vf5-4wqf AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

LOW Published 2026-04-01 Modified 2026-07-15 Official page ↗
Aliases
CVE-2026-34520
Ecosystem
PyPI
Packages
aiohttp
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-113
Reviewed
2026-04-01

Affected packages

• PyPI aiohttp: < 3.13.4 → fixed in 3.13.4

Description

Summary The C parser (the default for most installs) accepted null bytes and control characters in request headers. Impact An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `request.url.origin()` may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass. ----- Patch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4

Related

Alias · CVE (1)

  • CVE-2026-34520 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. vulnerability

Weakness · CWE (1)

  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers weakness

References