CVE-2026-34515

ADVISORY - github

Summary

On Windows the static resource handler may expose information about a NTLMv2 remote path.

Impact

If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.

Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d

EPSS Score⁠: 0.00057 (0.182)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-36⁠

Absolute Path Traversal

CWE-918⁠

Server-Side Request Forgery (SSRF)

ADVISORY - github

CWE-36⁠

Absolute Path Traversal

CWE-918⁠

Server-Side Request Forgery (SSRF)

ADVISORY - redhat

CWE-497⁠

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.