Is CVE-2026-34993 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34993 being exploited in the wild.

How severe is CVE-2026-34993?

Medium severity, with a CVSS score of 6.4, published 2 June 2026.

Which products and versions are affected?

aiohttp (PyPI) < 3.14.0, ECOSYSTEM:introduced=0,fixed=3.14.0.

Is there a fix for CVE-2026-34993?

Yes. aiohttp (PyPI): upgrade to 3.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34993 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-34993?

Check whether you run aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34993: aio-libs aiohttp code execution via deserialization in CookieJar.load

Q: Which products and versions are affected?

aiohttp (PyPI) < 3.14.0, ECOSYSTEM:introduced=0,fixed=3.14.0.

Q: Is there a fix for CVE-2026-34993?

Yes. aiohttp (PyPI): upgrade to 3.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34993 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-34993?

Check whether you run aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34993 · Severity: medium · CVSS 6.4 · Published 2026-06-02

AIOHTTP is a popular Python library used for building web servers and clients. A security flaw in how it handles saved cookie files could allow an attacker to execute malicious code on a system if they can trick the application into loading a specially crafted file. While this requires significant access to the system, it could lead to a full compromise of the application and its data.

Technologies: aiohttp (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-34993 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34993 being exploited in the wild.
How severe is CVE-2026-34993?: Medium severity, with a CVSS score of 6.4, published 2 June 2026.
Which products and versions are affected?: aiohttp (PyPI) < 3.14.0, ECOSYSTEM:introduced=0,fixed=3.14.0.
Is there a fix for CVE-2026-34993?: Yes. aiohttp (PyPI): upgrade to 3.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34993 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-34993?: Check whether you run aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

aiohttp (PyPI): upgrade to 3.14.0 or later
```
pip install "aiohttp>=3.14.0"
```

Technical details

A deserialization vulnerability (CWE-502) exists in the `CookieJar.load()` function of the aiohttp library. The root cause is the unsafe processing of untrusted data during the loading of cookie files, which can be leveraged to achieve arbitrary code execution. Exploitation requires a local attacker with high privileges to provide a malicious file and requires user interaction (triggering the load). The vulnerability is patched in version 3.14.0.

Affected products

aio-libs aiohttp < 3.14.0

Identifiers

CVE-2026-34993
GHSA-jg22-mg44-37j8
PYSEC-2026-2104

Timeline

2026-06-02: disclosed
2026-06-03: advisory
2026-06-03: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.