AIOHTTP hat HTTP-Antwortaufteilung über \r in der Begründungsphrase

The impact of CVE-2026-34519 hinges on whether an application allows untrusted data to be used in the response's reason parameter. If an application does, an attacker could manipulate the response headers to send something different from what the developer intended. This could involve injecting malicious headers that redirect users to phishing sites, modify content security policies, or otherwise alter the behavior of the application. While the vulnerability is rated as LOW severity, the potential for subtle manipulation of responses could lead to user confusion or, in more complex scenarios, compromise application security. The blast radius is limited to users interacting with the affected application’s responses.

Applications built using aiohttp versions 3.9.5 and earlier are at risk. This includes web applications, APIs, and microservices that rely on aiohttp for handling HTTP requests and responses. Specifically, applications that allow users to directly influence the content of HTTP responses are particularly vulnerable.

• python / server:

import aiohttp

# Check aiohttp version
import aiohttp
print(aiohttp.__version__)

# Inspect code for usage of aiohttp.Response with user-controlled 'reason'
# Look for code patterns like:
# response = aiohttp.Response(status=200, reason=user_input)

1. 2026-04-01Disclosure

   disclosure

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-01
3. Geändert2026-04-02
4. EPSS aktualisiert2026-04-09

The primary mitigation for CVE-2026-34519 is to upgrade to aiohttp version 3.13.4 or later. This version includes a fix that prevents the injection of arbitrary headers via the reason parameter. If upgrading is not immediately feasible, consider implementing input validation on the reason parameter to ensure that it only contains trusted data. While not a direct fix, a Web Application Firewall (WAF) configured to inspect and filter HTTP response headers could potentially block malicious header injections. After upgrading, confirm the fix by attempting to create a response with a crafted reason parameter containing potentially malicious header directives and verifying that the headers are not injected.