CVE-2026-34516: Aiohttp

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.

Affected products

• Aiohttp Aiohttp: before 3.13.4 (fixed in 3.13.4)

Published 2026-04-01. Last modified 2026-06-17.