PyPI: aiohttp
CVE-2026-34525
Safety vulnerability ID: SFTY-20260401-02448
Safety legacy ID: pyup.io-91428
Affected versions of the aiohttp package are vulnerable to HTTP Request Smuggling due to the acceptance of duplicate Host headers in incoming HTTP requests. The C extension HTTP parser failed to reject duplicate singleton headers such as Host, Content-Type, and Content-Length, creating parser differentials between the C and pure-Python implementations that could lead to inconsistent request interpretation. An attacker could send a crafted HTTP request containing multiple Host headers to bypass host-based access controls or poison routing decisions in upstream proxies and intermediaries.
Overview
AIOHTTP accepts duplicate Host headers
Advisory
Affected versions of the aiohttp package are vulnerable to HTTP Request Smuggling due to the acceptance of duplicate Host headers in incoming HTTP requests. The C extension HTTP parser failed to reject duplicate singleton headers such as Host, Content-Type, and Content-Length, creating parser differentials between the C and pure-Python implementations that could lead to inconsistent request interpretation. An attacker could send a crafted HTTP request containing multiple Host headers to bypass host-based access controls or poison routing decisions in upstream proxies and intermediaries.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260401-02448/CVE-2026-34525
- https://data.safetycli.com/changelogs/aiohttp/
- https://github.com/advisories/GHSA-c427-h43c-vf67
- https://pypi.org/project/aiohttp
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-c427-h43c-vf67
- https://nvd.nist.gov/vuln/detail/CVE-2026-34525
- https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000
- https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349
- https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4
- https://github.com/advisories/GHSA-c427-h43c-vf67
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more