CVE-2026-34515Medium▾ SunlitAIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
Last analysed / modified upstream
On Windows the static resource handler may expose information about a NTLMv2 remote path.
If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.
Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
aiohttp < 3.13.4Upgrade to a patched release:
aiohttp 3.13.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-22815Mediumaiohttp allows unlimited trailer headers, leading to possible uncapped memory usage
CVE-2026-34519LowAIOHTTP has HTTP response splitting via \r in reason phrase
CVE-2026-34516High· 7.5AIOHTTP has a Multipart Header Size Bypass
CVE-2026-34513LowAIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
CVE-2026-34525MediumAIOHTTP accepts duplicate Host headers
CVE-2026-34518Medium· 5.3AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect