[pkg-vuln] CVE-2026-34993 in aiohttp@3.13.5 #519

New Issue

kert · 2026-07-10T01:31:25Z

kert commented

2026-07-10 01:31:25 +00:00

Severity: MEDIUM
Package: aiohttp @ 3.13.5
Fixed in: 3.14.0

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-34993

**Severity:** MEDIUM **Package:** `aiohttp` @ `3.13.5` **Fixed in:** `3.14.0` AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading. **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-34993

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-07-10 01:31:25 +00:00

kert added the quality ci labels 2026-07-10 01:31:25 +00:00

kert commented

2026-07-10 17:18:56 +00:00

Not exploitable here. CVE-2026-34993 requires calling CookieJar.load() on attacker-controlled files; the stack never persists or loads cookie jars. aiohttp enters this stack only as a transitive client dependency of the fsspec cloud-storage backends (s3fs / gcsfs / adlfs via aiobotocore — uv tree --invert --package aiohttp), talking to fixed, trusted storage endpoints. Nothing in the repo runs an aiohttp server or imports aiohttp directly.

Bumped anyway (defense in depth): aiohttp 3.13.5 → 3.14.1 in 65c31cf88f (uv.lock + pkg-manifest; pyproject floor raised for direct deps). Advisory link is in the issue body.

**Not exploitable here.** CVE-2026-34993 requires calling `CookieJar.load()` on attacker-controlled files; the stack never persists or loads cookie jars. aiohttp enters this stack only as a transitive **client** dependency of the fsspec cloud-storage backends (s3fs / gcsfs / adlfs via aiobotocore — `uv tree --invert --package aiohttp`), talking to fixed, trusted storage endpoints. Nothing in the repo runs an aiohttp **server** or imports aiohttp directly. **Bumped anyway** (defense in depth): `aiohttp` 3.13.5 → 3.14.1 in https://git.fhirworx.io/homelab/stack/commit/65c31cf88fd8de552a006859159790de468403fb (uv.lock + pkg-manifest; pyproject floor raised for direct deps). Advisory link is in the issue body.

kert closed this issue

2026-07-10 17:18:56 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#519