AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4876 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4876-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     October 31, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-aiohttp     Version        : 3.8.4-1+deb12u2     CVE ID         : CVE-2025-53643 CVE-2025-69223 CVE-2025-69224 CVE-2025-69225                      CVE-2025-69226 CVE-2025-69227 CVE-2025-69228 CVE-2025-69229                      CVE-2026-22815 CVE-2026-34513 CVE-2026-34514 CVE-2026-34516                      CVE-2026-34517 CVE-2026-34518 CVE-2026-34519 CVE-2026-34520                      CVE-2026-34525 CVE-2026-34993 CVE-2026-47265 CVE-2026-50269                      CVE-2026-54274 CVE-2026-54277 CVE-2026-54279 CVE-2026-54280                      CVE-2026-59881 CVE-2026-69243     Debian Bug     : 1138780 1138781 1143160 1143597


    Several vulnerabilities have been found in aiohttp, an asynchronous     HTTP client/server framework for asyncio and Python.


    CVE-2025-53643

       Request smuggling vulnerability due to not parsing trailer sections        of an HTTP request.

    CVE-2025-69223

       Possible zip bomb attack against the server.

    CVE-2025-69224

       Possible request smuggling attack in the HTTP parser with the        presence of non-ASCII characters.

    CVE-2025-69225

       The parser logic allows non-ASCII decimals to be present in the        Range header.

    CVE-2025-69226

       A path traversal vulnerability that allows an attacker to ascertain        the existence of path components.

    CVE-2025-69227

       When processing a POST body, an infinite loop can occur when assert        statements are bypassed, leading to a DoS.

    CVE-2025-69228

       Exhausting the memory using Request.post() can freeze the server and        lead to a DoS.

    CVE-2025-69229

       The handling of chunked messages can result in an excessive blocking        of CPU usage when receiving a large number of chunks.

    CVE-2026-22815

       An uncapped memory usage due to insufficient restrictions in header        and trailer handling.

    CVE-2026-34513

       Excessive memory usage possibly resulting in a DoS due to an an        unbounded DNS cache.

    CVE-2026-34514

       Header injection.

    CVE-2026-34516

       Potential DoS vulnerability caused by a response with an excessive        number of multipart headers.

    CVE-2026-34517

       Possible excessive memory usage caused by some multipart form fields        due to reading the entiry field into memory before checking        client_max_size.

    CVE-2026-34518

       Leaking sensitive information by dropping the Cookie and the Proxy-        Authorization headers when following redirects to a different        origin.

    CVE-2026-34519

       Header injection via the reason parameter.

    CVE-2026-34520

       Possible security bypass by checking header values for control        characters accordingly to RFC 9110.

    CVE-2026-34525

       Disallow duplicate headers, like host headers, except for in lax        mode.

    CVE-2026-34993

       Arbitrary code execution when using CookieJar.load() with untrusted        input.

    CVE-2026-47265

       Possible data leak.

    CVE-2026-50269

       An attacker-controlled input included into multipart/payload headers        can be used to modify a request to inject additional headers or        similar.

    CVE-2026-54274

       An attacker can send large incomplete websocket frame payloads and        bypasses the usual size limits on memory use.

    CVE-2026-54277

       An attacker may be able to send oversized lines through the HTTP        parser and use an excessive amount of memory, potentially leading to        a DoS.

    CVE-2026-54279

       Host-only cookies saved with CookieJar.save() and then later        restored with CookieJar.load() lose their host-only status.

    CVE-2026-54280

       Possible resource starvation caused when payload resources are not        closed correctly when a client disconnects in the middle of a write.

    CVE-2026-59881

       The WebSocket client accepts and decompresses frames with the RSV1        bit set even when the permessage-deflate extension was not        negotiated, allowing a malicious server to cause unexpected CPU and        memory consumption.

    CVE-2026-69243

       The HTTP parsers are vulnerable to a request smuggling attack        relating to WebSocket upgrades.


    For Debian 12 bookworm, these problems have been fixed in version     3.8.4-1+deb12u2.

    We recommend that you upgrade your python-aiohttp packages.

    For the detailed security status of python-aiohttp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-aiohttp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-604898 advisory.

    [2.187.0-1.0.5]
    - Fix multiple CVEs in pyjwt, aiohttp, pyOpenSSL, multidict

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-
    controlled input included into multipart/payload headers can be used to modify a request to inject
    additional headers or similar. In the unlikely situation that an application is passing user-controlled
    strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to
    modify the request to inject headers or change the contents of the request. This vulnerability is fixed in
    3.14.0. (CVE-2026-50269)

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3208-1 advisory.

    - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart     headers       (bsc#1268398).
    - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource     consumption       (bsc#1268543).
    - CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via     excessive       resource consumption (bsc#1268544).
    - CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused     (bsc#1268549).
    - CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive     resource       consumption (bsc#1268556).
    - CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a     DoS       (bsc#1268559).
    - CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).
    - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a     write and       can cause resource starvation (bsc#1268561).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3207-1 advisory.

    This update for python-aiohttp fixes the following issues

    - CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and     a denial of       service (bsc#1261320).
    - CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service     (bsc#1261321).
    - CVE-2026-34514: `content_type` parameter manipulation can lead to header injection (bsc#1261322).
    - CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a     denial of       service (bsc#1261329).
    - CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of     service       (bsc#1261331).
    - CVE-2026-34518: retained `Cookie` and `Proxy-Authorization` headers when following redirects can lead to     information       disclosure (bsc#1261332).
    - CVE-2026-34519: response `reason` parameter can be use to perform header injection (bsc#1261334).
    - CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).
    - CVE-2026-34525: multiple `Host` headers allow for potential security bypass in proxy servers     (bsc#1261343).
    - CVE-2026-34993: loading untrusted input in `CookieJar.load()` can lead to arbitrary code execution     (bsc#1267471).
    - CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-     origin redirect       and can leak sensitive data (bsc#1267561).
    - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart     headers       (bsc#1268398).
    - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource     consumption       (bsc#1268543).
    - CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via     excessive       resource consumption (bsc#1268544).
    - CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused     (bsc#1268549).
    - CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive     resource       consumption (bsc#1268556).
    - CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a     DoS       (bsc#1268559).
    - CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).
    - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a     write and       can cause resource starvation (bsc#1268561).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21372-1 advisory.

    This update for python-aiohttp fixes the following issues

    - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart     headers       (bsc#1268398).
    - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource     consumption       (bsc#1268543).
    - CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via     excessive       resource consumption (bsc#1268544).
    - CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused     (bsc#1268549).
    - CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive     resource       consumption (bsc#1268556).
    - CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a     DoS       (bsc#1268559).
    - CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).
    - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a     write and       can cause resource starvation (bsc#1268561).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the aiohttp Python library installed on the remote host is prior to 3.14.0. It is, therefore, affected by a vulnerability:

  - Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify     a request to inject additional headers or similar. In the unlikely situation that an application is passing     user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may     be able to modify the request to inject headers or change the contents of the request. (CVE-2026-50269)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-     controlled input included into multipart/payload headers can be used to modify a request to inject     additional headers or similar. In the unlikely situation that an application is passing user-controlled     strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to     modify the request to inject headers or change the contents of the request. This vulnerability is fixed in     3.14.0. (CVE-2026-50269)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
374702	Debian dla-4876 : python-aiohttp-doc - security update	Nessus	Debian Local Security Checks	Local	high
370504	Oracle Linux 9 : python-oci-sdk (ELSA-2026-604898)	Nessus	Oracle Linux Local Security Checks	Local	high
460808	Echo: python-aiohttp: security update to 3.14.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460808	Echo: python-aiohttp: security update to 3.14.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
329282	SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3208-1)	Nessus	SuSE Local Security Checks	Local	high
329280	SUSE SLED15 / SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3207-1)	Nessus	SuSE Local Security Checks	Local	high
328918	openSUSE 16 Security Update : python-aiohttp (openSUSE-SU-2026:21372-1)	Nessus	SuSE Local Security Checks	Local	high
324957	Python Library aiohttp < 3.14.0 Header Injection	Nessus	Misc.	Local	medium
322127	Linux Distros Unpatched Vulnerability : CVE-2026-50269	Nessus	Misc.	Local	medium
443263	SCA: security update for aiohttp (GHSA-m6qw-4cw2-hm4m)	Tenable Cloud Security	SCA Checks	Local	medium
443263	SCA: security update for aiohttp (GHSA-m6qw-4cw2-hm4m)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-50269

medium

Tenable Plugins

high

high

medium

medium

high

high

high

medium

medium

medium

medium