CVE-2026-34515: Aiohttp

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.

Affected products

• Aiohttp Aiohttp: before 3.13.4 (fixed in 3.13.4)

Published 2026-04-01. Last modified 2026-06-17.