Is there a patch available for CVE-2026-34519?

Yes, a patch is available for CVE-2026-34519. Update the affected software to the latest version immediately.

Python CVE-2026-34519

Q: What is the CVSS score of CVE-2026-34519?

CVE-2026-34519 has a CVSS 4.0 base score of 2.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18044 LOW

HTTP Response Splitting (CWE-113)

2026-04-01 GitHub_M

GHSA-mwh4-6h8g-pg8w

Python Code Injection

2.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.7 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 01, 2026 - 21:00 euvd

EUVD-2026-18044

Analysis Generated

Apr 01, 2026 - 21:00 vuln.today

CVE Published

Apr 01, 2026 - 20:26 nvd

LOW 2.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

122 pypi packages depend on aiohttp (43 direct, 79 indirect)

Ecosystem-wide dependent count for version 3.13.4.

DescriptionGitHub Advisory

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

AnalysisAI

Header injection in AIOHTTP prior to version 3.13.4 allows remote attackers to inject arbitrary HTTP headers or conduct similar exploits by controlling the reason parameter when creating a Response object. The vulnerability has low real-world impact (CVSS 2.7, EPSS not available) and requires the attacker to control application-level input that directly influences the reason parameter; no public exploit code or active exploitation has been identified. A vendor-released patch is available in version 3.13.4.

Technical ContextAI

AIOHTTP is a Python asynchronous HTTP client/server framework built on asyncio. The vulnerability stems from improper handling of the reason parameter in the Response class, which is used to set the HTTP reason phrase (the text portion of the status line, e.g., 'OK' in '200 OK'). CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers) indicates the root cause: the reason parameter is not properly sanitized before being embedded in HTTP response headers, potentially allowing newline injection (CRLF) to introduce additional headers or payload data. The affected product is AIOHTTP versions prior to 3.13.4 across all supported platforms (CPE: cpe:2.3:a:aio-libs:aiohttp:*:*:*:*:*:*:*:*).

RemediationAI

Upgrade AIOHTTP to version 3.13.4 or later. The fix has been released and is available via PyPI; users should update via pip install --upgrade aiohttp>=3.13.4. For immediate mitigation prior to upgrade, do not pass user-controlled or untrusted input directly to the reason parameter of Response objects; validate or sanitize any application-level input before using it in HTTP response generation. Refer to the GitHub release page (https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4) and the security advisory for additional details.