CVE-2026-34525: Aiohttp

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.

Affected products

• Aiohttp Aiohttp: before 3.13.4 (fixed in 3.13.4)

Published 2026-04-01. Last modified 2026-06-17.