---
id: CVE-2026-34516
aliases:
  - GHSA-m5qp-6w8w-w647
  - PYSEC-2026-2098
title: AIOHTTP has a Multipart Header Size Bypass
summary: AIOHTTP has a Multipart Header Size Bypass
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: aiohttp
product: aiohttp
ecosystem: pip
affected:
  - aiohttp < 3.13.4
patched:
  - aiohttp 3.13.4
published: '2026-04-01'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:02.372876858Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-m5qp-6w8w-w647'
references:
  - url: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m5qp-6w8w-w647
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34516'
  - url: >-
      https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f
  - url: 'https://github.com/aio-libs/aiohttp'
  - url: 'https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4'
tags:
  - osv
  - pip
epss: 0.00609
epssPercentile: 0.46847
ingestedAt: '2026-07-13T18:58:00.325Z'
---

## Overview

### Summary

A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.

### Impact

Multipart headers were not subject to the same size restrictions in place for normal headers, potentially allowing substantially more data to be loaded into memory than intended. However, other restrictions in place limit the impact of this vulnerability.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f

## Affected packages

- `aiohttp < 3.13.4`

## Remediation

Upgrade to a patched release:

- `aiohttp 3.13.4`