---
id: CVE-2026-34515
aliases:
  - GHSA-p998-jp59-783m
  - PYSEC-2026-2097
title: >-
  AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static
  resource handler on Windows
summary: >-
  AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static
  resource handler on Windows
severity: medium
vendor: aiohttp
product: aiohttp
ecosystem: pip
affected:
  - aiohttp < 3.13.4
patched:
  - aiohttp 3.13.4
published: '2026-04-01'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:02.565661873Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-p998-jp59-783m'
references:
  - url: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34515'
  - url: >-
      https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
  - url: 'https://github.com/aio-libs/aiohttp'
  - url: 'https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4'
tags:
  - osv
  - pip
epss: 0.00497
epssPercentile: 0.3996
ingestedAt: '2026-07-13T18:58:01.320Z'
---

## Overview

### Summary

On Windows the static resource handler may expose information about a NTLMv2 remote path.

### Impact

If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d

## Affected packages

- `aiohttp < 3.13.4`

## Remediation

Upgrade to a patched release:

- `aiohttp 3.13.4`