CVE-2026-34514
ADVISORY - githubSummary
Summary
An attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits.
Impact
If an application allows untrusted data to be used for the multipart content_type parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.
Patch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06
EPSS Score: 0.00045 (0.138)
Common Weakness Enumeration (CWE)
ADVISORY - nist
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
ADVISORY - github
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
ADVISORY - redhat
Improper Neutralization of CRLF Sequences ('CRLF Injection')
NIST
CREATED
UPDATED
ADVISORY IDCVE-2026-34514
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
2.7lowGitHub
CREATED
UPDATED
ADVISORY IDGHSA-2vrm-gr82-f7m5
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
2.7lowDebian
CREATED
UPDATED
ADVISORY IDCVE-2026-34514
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Ubuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-34514
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AmediumRed Hat
CREATED
UPDATED
ADVISORY IDCVE-2026-34514
EXPLOITABILITY SCORE
3.9
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
5.3mediumChainguard
CREATED
UPDATED
ADVISORY ID
CGA-w87m-w89f-3c8p
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-