{"id":"CVE-2026-50269","aliases":["GHSA-m6qw-4cw2-hm4m","PYSEC-2026-2106"],"title":"aiohttp: CRLF injection in multipart headers","summary":"aiohttp: CRLF injection in multipart headers","severity":"low","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.14.0"],"patched":["aiohttp 3.14.0"],"published":"2026-06-15","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:09.078868018Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-m6qw-4cw2-hm4m","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m"},{"url":"https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8"},{"url":"https://github.com/aio-libs/aiohttp"},{"url":"https://github.com/advisories/GHSA-m6qw-4cw2-hm4m"}],"tags":["osv","pip","ghsa"],"epss":0.00301,"epssPercentile":0.23,"cwe":["CWE-93","CWE-113"],"ingestedAt":"2026-07-07T15:41:58.696Z","slug":"CVE-2026-50269","body":"## Overview\n\n### Summary\n\nAttacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.\n\n### Impact\n\nIn the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.\n\n### Workaround\n\nSanitise such user input.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8\n\n## Affected packages\n\n- `aiohttp < 3.14.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.14.0`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}