[pkg-vuln] CVE-2026-34525 in aiohttp@3.13.3 #321

New Issue

kert · 2026-04-02T17:37:20Z

kert commented

2026-04-02 17:37:20 +00:00

Severity: MEDIUM
Package: aiohttp @ 3.13.3
Fixed in: 3.13.4

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-34525

**Severity:** MEDIUM **Package:** `aiohttp` @ `3.13.3` **Fixed in:** `3.13.4` AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4. **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-34525

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-04-02 17:37:20 +00:00

kert added the ci quality labels 2026-04-02 17:37:20 +00:00

kert closed this issue

2026-04-10 00:57:09 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#321