AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4,
    an attacker who controls the reason parameter when creating a Response may be able to inject extra headers
    or similar exploits. This issue has been patched in version 3.13.4. (CVE-2026-34519)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3207-1 advisory.

    This update for python-aiohttp fixes the following issues

    - CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and     a denial of       service (bsc#1261320).
    - CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service     (bsc#1261321).
    - CVE-2026-34514: `content_type` parameter manipulation can lead to header injection (bsc#1261322).
    - CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a     denial of       service (bsc#1261329).
    - CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of     service       (bsc#1261331).
    - CVE-2026-34518: retained `Cookie` and `Proxy-Authorization` headers when following redirects can lead to     information       disclosure (bsc#1261332).
    - CVE-2026-34519: response `reason` parameter can be use to perform header injection (bsc#1261334).
    - CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).
    - CVE-2026-34525: multiple `Host` headers allow for potential security bypass in proxy servers     (bsc#1261343).
    - CVE-2026-34993: loading untrusted input in `CookieJar.load()` can lead to arbitrary code execution     (bsc#1267471).
    - CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-     origin redirect       and can leak sensitive data (bsc#1267561).
    - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart     headers       (bsc#1268398).
    - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource     consumption       (bsc#1268543).
    - CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via     excessive       resource consumption (bsc#1268544).
    - CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused     (bsc#1268549).
    - CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive     resource       consumption (bsc#1268556).
    - CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a     DoS       (bsc#1268559).
    - CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).
    - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a     write and       can cause resource starvation (bsc#1268561).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3059-1 advisory.

    This update for python-aiohttp fixes the following issues

    - CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
    - CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
    - CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
    - CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
    - CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
    - CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information     disclosure (bsc#1261332).
    - CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
    - CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
    - CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
    - CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
    - CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-     origin redirect (bsc#1267561).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22173-1 advisory.

    This update for python-aiohttp fixes the following issues

    - CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
    - CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
    - CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
    - CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
    - CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
    - CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information     disclosure       (bsc#1261332).
    - CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
    - CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
    - CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
    - CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
    - CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-     origin redirect       (bsc#1267561).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4613 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4613-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     June 01, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-aiohttp     Version        : 3.7.4-1+deb11u2     CVE ID         : CVE-2025-53643 CVE-2025-69224 CVE-2025-69225 CVE-2025-69226                      CVE-2025-69227 CVE-2025-69228 CVE-2025-69229 CVE-2026-22815                      CVE-2026-34513 CVE-2026-34514 CVE-2026-34516 CVE-2026-34517                      CVE-2026-34518 CVE-2026-34519 CVE-2026-34520 CVE-2026-34525


    Several vulnerabilities have been found in aiohttp, an asynchronous     HTTP client/server framework for asyncio and Python.


    CVE-2025-53643

       Request smuggling vulnerability due to not parsing trailer sections        of an HTTP request.

    CVE-2025-69224

       Possible request smuggling attack in the HTTP parser with the        presence of non-ASCII characters.

    CVE-2025-69225

       Parser logic which allows non-ASCII decimals to be present in the        Range header.

    CVE-2025-69226

       Path traversal vulnerability that allows an attacker to ascertain        the existence of path components.

    CVE-2025-69227

       When processing a POST body, an infinite loop can occur when assert        statements are bypassed leading to a possible DoS attack.

    CVE-2025-69228

       Possible DoS attack that can freeze the server by exhausting the        memory using Request.post().

    CVE-2025-69229

       The handling of chunked messages that can result in an excessive        blocking of CPU usage when receiving a large number of chunks.

    CVE-2026-22815

       Uncapped memory usage due to insufficient restrictions in header and        trailer handling.

    CVE-2026-34513

       Excessive memory usage possibly resulting in a DoS due to an an        unbounded DNS cache.

    CVE-2026-34514

       Header injection.

    CVE-2026-34516

       Potential DoS vulnerability caused by a response with an excessive        number of multipart headers.

    CVE-2026-34517

       Possible excessive memory usage caused by some multipart form fields        due to reading the entiry field into memory before checking        client_max_size.

    CVE-2026-34518

       Leaking sensitive information by dropping the Cookie and the Proxy-        Authorization headers When following redirects to a different        origin.

    CVE-2026-34519

       Header injection via the reason parameter.

    CVE-2026-34520

       Possible security bypass by checking header values for control        characters accordingly to RFC 9110.

    CVE-2026-34525

       Headers can be duplicated, e.g. the host header.


    For Debian 11 bullseye, these problems have been fixed in version     3.7.4-1+deb11u2.

    We recommend that you upgrade your python-aiohttp packages.

    For the detailed security status of python-aiohttp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-aiohttp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of aioHTTP installed on the remote host is prior to 3.13.4. It is, therefore, affected by a request smuggling vulnerability:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4,     insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has     been patched in version 3.13.4. (CVE-2026-22815)

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4,     a response with an excessive number of multipart headers may be allowed to use more memory than intended,     potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4. (CVE-2026-34516)

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4,     multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.     (CVE-2026-34525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4,     an attacker who controls the reason parameter when creating a Response may be able to inject extra headers     or similar exploits. This issue has been patched in version 3.13.4. (CVE-2026-34519)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458685	Echo: python-aiohttp: security update to 3.13.3-3+e4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458685	Echo: python-aiohttp: security update to 3.13.3-3+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
329280	SUSE SLED15 / SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3207-1)	Nessus	SuSE Local Security Checks	Local	high
327318	SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3059-1)	Nessus	SuSE Local Security Checks	Local	high
323099	SUSE SLES16 Security Update : python-aiohttp (SUSE-SU-2026:22173-1)	Nessus	SuSE Local Security Checks	Local	high
318080	Debian dla-4613 : python-aiohttp-doc - security update	Nessus	Debian Local Security Checks	Local	high
304811	aioHTTP < 3.13.4 Multiple Vulnerabilities (CVE-2026-22815)	Nessus	Misc.	Local	high
304758	Linux Distros Unpatched Vulnerability : CVE-2026-34519	Nessus	Misc.	Local	medium
439654	SCA: security update for aiohttp (GHSA-mwh4-6h8g-pg8w)	Tenable Cloud Security	SCA Checks	Local	medium
439654	SCA: security update for aiohttp (GHSA-mwh4-6h8g-pg8w)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-34519

medium

Tenable Plugins

medium

medium

high

high

high

high

high

medium

medium

medium