CVE-2026-34520Critical· 9.1▾ MidnightAIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.5%
Last analysed / modified upstream
The C parser (the default for most installs) accepted null bytes and control characters in request headers.
An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, request.url.origin() may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.
Patch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4
aiohttp < 3.13.4Upgrade to a patched release:
aiohttp 3.13.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-22815Mediumaiohttp allows unlimited trailer headers, leading to possible uncapped memory usage
CVE-2026-34515MediumAIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
CVE-2026-34519LowAIOHTTP has HTTP response splitting via \r in reason phrase
CVE-2026-34516High· 7.5AIOHTTP has a Multipart Header Size Bypass
CVE-2026-34513LowAIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
CVE-2026-34525MediumAIOHTTP accepts duplicate Host headers