Executive brief
AIOHTTP is a popular Python library used by developers to build web servers and clients. A security flaw allows attackers to inject unauthorized information into web requests if the application handles user-provided data incorrectly. This could lead to the modification of request contents or the injection of malicious headers, potentially compromising how the application communicates with other services.
Technical details
A CRLF injection vulnerability exists in aiohttp's handling of multipart and payload headers. The root cause is improper neutralization of carriage return and line feed sequences when user-controlled strings are passed into MultipartWriter.append(headers=...) or Payload.headers. An attacker can exploit this by providing specially crafted input that injects additional HTTP headers or modifies the request body. This is a network-reachable vulnerability that requires the application to be specifically configured to pass unsanitized user input into these header fields. The issue is fixed in version 3.14.0 by rejecting invalid bytes in these components.
Affected products
- aio-libs aiohttp < 3.14.0
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date