https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 04:55:06 +0000 https://vulnerability.circl.lu/vuln/cve-2026-34520 <p><strong>Affected:</strong> aio-libs aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.</p> <p><strong>Affected:</strong> aio-libs aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.</p> https://vulnerability.circl.lu/vuln/cve-2026-34520 https://vulnerability.circl.lu/vuln/ghsa-63hf-3vf5-4wqf <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>The C parser (the default for most installs) accepted null bytes and control characters in request headers.</p> <p>### Impact</p> <p>An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `request.url.origin()` may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>The C parser (the default for most installs) accepted null bytes and control characters in request headers.</p> <p>### Impact</p> <p>An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `request.url.origin()` may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4</p> https://vulnerability.circl.lu/vuln/ghsa-63hf-3vf5-4wqf https://vulnerability.circl.lu/vuln/pysec-2026-2102 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.</p> https://vulnerability.circl.lu/vuln/pysec-2026-2102