CVE-2026-34519: AIOHTTP has HTTP response splitting via \r in reason phrase

April 1, 2026

An attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits.

References

github.com/advisories/GHSA-mwh4-6h8g-pg8w
github.com/aio-libs/aiohttp
github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b
github.com/aio-libs/aiohttp/releases/tag/v3.13.4
github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8w
nvd.nist.gov/vuln/detail/CVE-2026-34519

Code Behaviors & Features

Detect and mitigate CVE-2026-34519 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →