Vendor
Aiohttp vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 16 vulnerabilities in Aiohttp: 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-34525, was published on 1 April 2026. 1 technology has a page of its own.
- Last 7 days
- 0
- Last 90 days
- 0
- Critical, all time
- 1
- Exploited in the wild
- 0
About Aiohttp
Python asynchronous HTTP client and server library for building async web applications.
Aiohttp technologies
- Aiohttp16
Latest Aiohttp vulnerabilities
- CVE-2026-34525: AIOHTTP accepts duplicate Host headersmediumCVSS 5.3EPSS 0.3%
- CVE-2026-34520: aio-libs aiohttp header injection in llhttp C parsercriticalCVSS 9.1EPSS 0.5%
- CVE-2026-34519: AIOHTTP has HTTP response splitting via \r in reason phrasemediumCVSS 5.3EPSS 0.3%
- CVE-2026-34518: AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirectmediumCVSS 5.3EPSS 0.3%
- CVE-2026-34517: AIOHTTP has late size enforcement for non-file multipart fields causes memory DoSmediumCVSS 5.3EPSS 0.4%
- CVE-2026-34516: AIOHTTP has a Multipart Header Size BypasshighCVSS 7.5EPSS 0.4%
- CVE-2026-34515: AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on WindowshighCVSS 7.5EPSS 0.4%
- CVE-2026-34514: aiohttp CRLF injection in multipart content type headermediumCVSS 5.3EPSS 0.3%
- CVE-2026-34513: AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnectorhighCVSS 7.5EPSS 0.4%
- CVE-2026-22815: aiohttp allows unlimited trailer headers, leading to possible uncapped memory usagehighCVSS 7.5EPSS 0.4%
- CVE-2025-69229: PYSEC-2026-1106 - AIOHTTP vulnerable to DoS through chunked messagesmediumCVSS 5.3EPSS 0.4%
- CVE-2025-69228: PYSEC-2026-1100 - AIOHTTP vulnerable to denial of service through large payloadshighCVSS 7.5EPSS 0.4%
- CVE-2025-69227: PYSEC-2026-1107 - AIOHTTP vulnerable to DoS when bypassing assertshighCVSS 7.5EPSS 0.4%
- CVE-2025-69225: PYSEC-2026-1109 - AIOHTTP has unicode match groups in regexes for ASCII protocol elementsmediumCVSS 5.3EPSS 0.3%
- CVE-2025-69226: PYSEC-2026-1097 - AIOHTTP vulnerable to brute-force leak of internal static file path componentsmediumCVSS 5.3EPSS 0.4%
- CVE-2025-69224: PYSEC-2026-1099 - AIOHTTP's unicode processing of header values could cause parsing discrepanciesmediumCVSS 6.5EPSS 0.2%
Most severe Aiohttp vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-34520: aio-libs aiohttp header injection in llhttp C parsercriticalCVSS 9.1EPSS 0.5%
- CVE-2026-34516: AIOHTTP has a Multipart Header Size BypasshighCVSS 7.5EPSS 0.4%
- CVE-2026-34513: AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnectorhighCVSS 7.5EPSS 0.4%
- CVE-2026-22815: aiohttp allows unlimited trailer headers, leading to possible uncapped memory usagehighCVSS 7.5EPSS 0.4%
- CVE-2026-34515: AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on WindowshighCVSS 7.5EPSS 0.4%
- CVE-2025-69228: PYSEC-2026-1100 - AIOHTTP vulnerable to denial of service through large payloadshighCVSS 7.5EPSS 0.4%
- CVE-2025-69227: PYSEC-2026-1107 - AIOHTTP vulnerable to DoS when bypassing assertshighCVSS 7.5EPSS 0.4%
- CVE-2025-69224: PYSEC-2026-1099 - AIOHTTP's unicode processing of header values could cause parsing discrepanciesmediumCVSS 6.5EPSS 0.2%
- CVE-2025-69229: PYSEC-2026-1106 - AIOHTTP vulnerable to DoS through chunked messagesmediumCVSS 5.3EPSS 0.4%
- CVE-2026-34517: AIOHTTP has late size enforcement for non-file multipart fields causes memory DoSmediumCVSS 5.3EPSS 0.4%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Aiohttp vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/aiohttp)<a href="https://junglewise.ai/threats/vendors/aiohttp"><img src="https://junglewise.ai/threats/vendors/aiohttp/badge.svg" alt="Aiohttp vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/aiohttp.json, and this page as text at https://junglewise.ai/threats/vendors/aiohttp.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Aiohttp vulnerabilities", https://junglewise.ai/threats/vendors/aiohttp, 9 November 2026.