Executive brief
aiohttp is a popular Python HTTP client library used by many web applications. A CRLF injection vulnerability in the multipart request construction allows an attacker who can control the content_type parameter to inject additional HTTP headers or manipulate the request structure, potentially leading to request smuggling or header spoofing attacks.
Technical details
This vulnerability is a CRLF (Carriage Return Line Feed) injection in the multipart part content type header construction. The root cause is insufficient validation of user-supplied content_type parameters when building multipart request bodies. An attacker who can control this parameter can inject carriage return and line feed characters to break out of the header and inject arbitrary headers or content. The attack requires that an application passes untrusted data directly to the multipart content_type parameter. Exploitation could result in request smuggling or header injection attacks. A patch was released in version 3.13.4 (commit 9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06).
Affected products
- aio-libs aiohttp before 3.13.4
Timeline
- 2026-04-01: disclosed: Advisory published on GitHub
- 2026-04-01: patched: Fix released in version 3.13.4