Is there a patch available for CVE-2026-34514?

Yes, a patch is available for CVE-2026-34514. Update the affected software to the latest version immediately.

Python CVE-2026-34514

Q: What is the CVSS score of CVE-2026-34514?

CVE-2026-34514 has a CVSS 4.0 base score of 2.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18037 LOW

HTTP Response Splitting (CWE-113)

2026-04-01 GitHub_M

GHSA-2vrm-gr82-f7m5

Python Code Injection

2.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.7 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 01, 2026 - 21:00 euvd

EUVD-2026-18037

Analysis Generated

Apr 01, 2026 - 21:00 vuln.today

CVE Published

Apr 01, 2026 - 20:09 nvd

LOW 2.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

122 pypi packages depend on aiohttp (43 direct, 79 indirect)

Ecosystem-wide dependent count for version 3.13.4.

DescriptionGitHub Advisory

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

AnalysisAI

Header injection in AIOHTTP prior to version 3.13.4 allows unauthenticated remote attackers to inject arbitrary headers by controlling the content_type parameter, potentially enabling HTTP response splitting or cache poisoning attacks. The vulnerability has a low CVSS score (2.7) reflecting limited integrity impact, but affects all versions before the patched release 3.13.4.

Technical ContextAI

AIOHTTP is a Python asynchronous HTTP client/server framework built on asyncio. The vulnerability stems from improper sanitization of the content_type parameter (CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers). When an attacker controls the content_type input, they can inject newline characters (\r\n) to insert additional HTTP headers into responses. This classic HTTP header injection technique can lead to cache poisoning, session fixation, or response splitting attacks depending on downstream systems and configuration. The affected CPE range covers all AIOHTTP versions before 3.13.4.

RemediationAI

Upgrade AIOHTTP to version 3.13.4 or later. This patched version is available at https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4 and resolves the header injection vulnerability. Applications should update their dependency specifications and redeploy accordingly. If immediate patching is not feasible, applications should validate and sanitize content_type parameters to reject or escape CRLF sequences before passing them to AIOHTTP functions.