{"id":"CVE-2026-34519","aliases":["GHSA-mwh4-6h8g-pg8w","PYSEC-2026-2101"],"title":"AIOHTTP has HTTP response splitting via \\r in reason phrase","summary":"AIOHTTP has HTTP response splitting via \\r in reason phrase","severity":"low","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.13.4"],"patched":["aiohttp 3.13.4"],"published":"2026-04-01","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:44.819886754Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-mwh4-6h8g-pg8w","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8w"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34519"},{"url":"https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b"},{"url":"https://github.com/aio-libs/aiohttp"},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"tags":["osv","pip"],"epss":0.00292,"epssPercentile":0.22067,"ingestedAt":"2026-07-13T18:58:00.931Z","slug":"CVE-2026-34519","body":"## Overview\n\n### Summary\n\nAn attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.\n\n### Impact\n\nIn the unlikely situation that an application allows untrusted data to be used in the response's `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b\n\n## Affected packages\n\n- `aiohttp < 3.13.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.13.4`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}