Is there a patch available for CVE-2026-34517?

Yes, a patch is available for CVE-2026-34517. Update the affected software to the latest version immediately.

Python CVE-2026-34517

Q: What is the CVSS score of CVE-2026-34517?

CVE-2026-34517 has a CVSS 4.0 base score of 2.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18041 LOW

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-01 GitHub_M

GHSA-3wq7-rqq7-wx6j

Python Denial Of Service

2.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.7 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 01, 2026 - 21:00 euvd

EUVD-2026-18041

Analysis Generated

Apr 01, 2026 - 21:00 vuln.today

CVE Published

Apr 01, 2026 - 20:14 nvd

LOW 2.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

122 pypi packages depend on aiohttp (43 direct, 79 indirect)

Ecosystem-wide dependent count for version 3.13.4.

DescriptionGitHub Advisory

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.

AnalysisAI

Aiohttp prior to version 3.13.4 allocates entire multipart form fields into memory before validating against the client_max_size limit, enabling unauthenticated remote attackers to cause denial of service through memory exhaustion. The vulnerability affects all versions before 3.13.4 and carries a low CVSS score (2.7) reflecting limited availability impact, with no public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

Aiohttp is a Python asynchronous HTTP framework built on asyncio, commonly used for building high-concurrency web services. The vulnerability exists in multipart form data parsing logic (CWE-770: Allocation of Resources Without Limits or Throttling), where the framework loads multipart fields entirely into memory before enforcing the client_max_size constraint. This violates the principle of streaming parsing and fail-safe defaults. The issue is specific to multipart/form-data content-type handling; the affected CPE is cpe:2.3:a:aio-libs:aiohttp:*:*:*:*:*:*:*:* with versions prior to 3.13.4 impacted.

RemediationAI

Vendor-released patch: Aiohttp 3.13.4 or later. Upgrade immediately via pip (pip install --upgrade aiohttp>=3.13.4) to receive the fix commit cbb774f38330563422ca0c413a71021d7b944145, which enforces client_max_size validation before full field buffering. No workarounds are documented for earlier versions other than external request-size filtering at the load-balancer or reverse-proxy layer (e.g., nginx client_max_body_size directive). See https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4 for release notes and https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3wq7-rqq7-wx6j for advisory details.