Is there a patch available for CVE-2026-34520?

Yes, a patch is available for CVE-2026-34520. Update the affected software to the latest version immediately.

Python CVE-2026-34520

Q: What is the CVSS score of CVE-2026-34520?

CVE-2026-34520 has a CVSS 4.0 base score of 2.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18046 LOW

HTTP Response Splitting (CWE-113)

2026-04-01 GitHub_M

GHSA-63hf-3vf5-4wqf

Python Information Disclosure

2.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.7 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 01, 2026 - 21:00 euvd

EUVD-2026-18046

Analysis Generated

Apr 01, 2026 - 21:00 vuln.today

CVE Published

Apr 01, 2026 - 20:27 nvd

LOW 2.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

122 pypi packages depend on aiohttp (43 direct, 79 indirect)

Ecosystem-wide dependent count for version 3.13.4.

DescriptionGitHub Advisory

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

AnalysisAI

AIOHTTP's C parser accepts null bytes and control characters in HTTP response headers prior to version 3.13.4, allowing remote attackers to inject malformed headers that bypass validation and cause information disclosure. This vulnerability affects all versions before 3.13.4 and has been patched upstream; exploitation requires no authentication or user interaction but results in limited integrity impact to response headers rather than confidentiality breach.

Technical ContextAI

AIOHTTP is a Python asyncio-based HTTP client/server framework that uses a C-based parser for performance optimization on most installations. The vulnerability resides in the C parser's header parsing logic (CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers), which fails to properly validate and sanitize control characters (ASCII 0x00-0x1F) and null bytes (0x00) in HTTP response header values. These characters should be rejected per RFC 7230 HTTP specification, but the parser accepts them, allowing attackers to craft malicious response headers that may include newline injection (CRLF injection), header smuggling, or other header-based attacks. The vulnerability is specific to the C parser implementation; Python-based parser implementations may not be affected.

RemediationAI

Upgrade AIOHTTP to version 3.13.4 or later immediately. For Python environments, execute pip install --upgrade aiohttp>=3.13.4 or update your requirements file and reinstall. Organizations unable to upgrade immediately should monitor for suspicious response headers containing control characters or null bytes in upstream HTTP responses; however, no robust application-level workaround can fully mitigate the parser flaw. Verification of the patched version can be confirmed by checking the installed version with pip show aiohttp. See the official security advisory at https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqf for additional context.