CVE-2026-50269
2 advisories.
PyPI/aiohttp CVE-2026-50269: low, EPSS 0.53%
aiohttp: CRLF injection in multipart headers
Action: Upgrade aiohttp to 3.14.0 or later.
pip install aiohttp==3.14.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.14.0 | - |
Fixed versions
| 3.14.0 |
Sources
- osv: GHSA-m6qw-4cw2-hm4m
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m
- https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8
- https://github.com/aio-libs/aiohttp
CVE-2026-50269 · published · modified · JSON
PyPI/aiohttp CVE-2026-50269: high 7.5, EPSS 0.53%
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to in
Action: Upgrade aiohttp to 3.14.0 or later.
pip install aiohttp==3.14.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.14.0 | - |
Fixed versions
| 3.14.0 |
Sources
- osv: PYSEC-2026-2106
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m
- https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8
CVE-2026-50269 · published · modified · JSON