CVE-2026-34525

MEDIUM

AIOHTTP: Duplicate Host header accepted

Title source: cna

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.

References (4)

Scores

CVSS v3 5.3
EPSS 0.0012
EPSS Percentile 30.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-20 CWE-444
Status published
Products (3)
aiohttp/aiohttp < 3.13.4
aio-libs/aiohttp < 3.13.4
pypi/aiohttp 0 - 3.13.4PyPI
Published Apr 01, 2026
Tracked Since Apr 02, 2026