---
id: CVE-2026-34520
aliases:
  - GHSA-63hf-3vf5-4wqf
  - PYSEC-2026-2102
title: >-
  AIOHTTP's C parser (llhttp) accepts null bytes and control characters in
  response header values - header injection/security bypass
summary: >-
  AIOHTTP's C parser (llhttp) accepts null bytes and control characters in
  response header values - header injection/security bypass
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
vendor: aiohttp
product: aiohttp
ecosystem: pip
affected:
  - aiohttp < 3.13.4
patched:
  - aiohttp 3.13.4
published: '2026-04-01'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:43.255807027Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-63hf-3vf5-4wqf'
references:
  - url: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqf
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34520'
  - url: >-
      https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4
  - url: 'https://github.com/aio-libs/aiohttp'
  - url: 'https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2026-2102.yaml
tags:
  - osv
  - pip
epss: 0.00676
epssPercentile: 0.50118
ingestedAt: '2026-07-13T18:57:53.610Z'
---

## Overview

### Summary

The C parser (the default for most installs) accepted null bytes and control characters in request headers.

### Impact

An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `request.url.origin()` may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4

## Affected packages

- `aiohttp < 3.13.4`

## Remediation

Upgrade to a patched release:

- `aiohttp 3.13.4`