CVE-2026-34520: Aiohttp

Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

Affected products

• Aiohttp Aiohttp: before 3.13.4 (fixed in 3.13.4)

Published 2026-04-01. Last modified 2026-06-17.