https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:56:36 +0000 https://vulnerability.circl.lu/vuln/cve-2026-50269 <p><strong>Affected:</strong> aio-libs aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.</p> <p><strong>Affected:</strong> aio-libs aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-50269 https://vulnerability.circl.lu/vuln/ghsa-m6qw-4cw2-hm4m <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.</p> <p>### Impact</p> <p>In the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.</p> <p>### Workaround</p> <p>Sanitise such user input.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.</p> <p>### Impact</p> <p>In the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.</p> <p>### Workaround</p> <p>Sanitise such user input.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8</p> https://vulnerability.circl.lu/vuln/ghsa-m6qw-4cw2-hm4m https://vulnerability.circl.lu/vuln/pysec-2026-2106 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.</p> https://vulnerability.circl.lu/vuln/pysec-2026-2106