CVE-2026-50269: aiohttp: CRLF injection in multipart headers

June 15, 2026

Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.

References

github.com/advisories/GHSA-m6qw-4cw2-hm4m
github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8
github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m
nvd.nist.gov/vuln/detail/CVE-2026-50269

Code Behaviors & Features

Detect and mitigate CVE-2026-50269 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →