[pkg-vuln] CVE-2026-50269 in aiohttp@3.13.5 #526

New Issue

kert · 2026-07-10T01:31:26Z

kert commented

2026-07-10 01:31:26 +00:00

Severity: LOW
Package: aiohttp @ 3.13.5
Fixed in: 3.14.0

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerabi

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-50269

**Severity:** LOW **Package:** `aiohttp` @ `3.13.5` **Fixed in:** `3.14.0` AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerabi **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-50269

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-07-10 01:31:26 +00:00

kert added the quality ci labels 2026-07-10 01:31:26 +00:00

kert commented

2026-07-10 17:18:58 +00:00

Not exploitable here. CVE-2026-50269 requires passing user-controlled strings into MultipartWriter.append(headers=...); there is no direct aiohttp usage at all. aiohttp enters this stack only as a transitive client dependency of the fsspec cloud-storage backends (s3fs / gcsfs / adlfs via aiobotocore — uv tree --invert --package aiohttp), talking to fixed, trusted storage endpoints. Nothing in the repo runs an aiohttp server or imports aiohttp directly.

Bumped anyway (defense in depth): aiohttp 3.13.5 → 3.14.1 in 65c31cf88f (uv.lock + pkg-manifest; pyproject floor raised for direct deps). Advisory link is in the issue body.

**Not exploitable here.** CVE-2026-50269 requires passing user-controlled strings into `MultipartWriter.append(headers=...)`; there is no direct aiohttp usage at all. aiohttp enters this stack only as a transitive **client** dependency of the fsspec cloud-storage backends (s3fs / gcsfs / adlfs via aiobotocore — `uv tree --invert --package aiohttp`), talking to fixed, trusted storage endpoints. Nothing in the repo runs an aiohttp **server** or imports aiohttp directly. **Bumped anyway** (defense in depth): `aiohttp` 3.13.5 → 3.14.1 in https://git.fhirworx.io/homelab/stack/commit/65c31cf88fd8de552a006859159790de468403fb (uv.lock + pkg-manifest; pyproject floor raised for direct deps). Advisory link is in the issue body.

kert closed this issue

2026-07-10 17:18:58 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#526