AIOHTTP's C parser (llhttp) akzeptiert Nullbytes und Steuerzeichen in Antwortheaderwerten - Header-Injektion/Sicherheitsumgehung

The core of the vulnerability lies in the C parser (the default for most installations) accepting control characters in response headers. This allows an attacker to craft malicious header values that are interpreted differently than intended. A prime example is the request.url.origin() function, which might return a value different from the raw Host header or what a reverse proxy has interpreted it as. This discrepancy can be leveraged to bypass authentication mechanisms, access restricted resources, or even manipulate application logic. The potential for security bypass is significant, as it undermines the integrity of header-based security controls. The blast radius could extend to any application relying on aiohttp for handling HTTP requests and responses, particularly those that trust header information for security decisions.

Applications built using aiohttp, particularly those deployed in production environments and handling sensitive data, are at risk. Services relying on accurate header parsing for authentication, authorization, or routing are especially vulnerable. Shared hosting environments where users have limited control over server configurations are also at increased risk.

• python / server:

import aiohttp

async def check_aiohttp_version():
    try:
        import aiohttp
        print(f"aiohttp version: {aiohttp.__version__}")
        if aiohttp.__version__ <= '3.9.5':
            print("VULNERABLE: aiohttp version is less than or equal to 3.9.5")
        else:
            print("aiohttp version is not vulnerable.")
    except ImportError:
        print("aiohttp is not installed.")

if __name__ == '__main__':
    import asyncio
    asyncio.run(check_aiohttp_version())

• generic web:

curl -I https://example.com | grep -i 'Content-Type:'

Inspect the Content-Type header for unexpected characters or encodings that might indicate manipulation.

1. 2026-04-01Disclosure

   disclosure

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-01
3. Geändert2026-04-06
4. EPSS aktualisiert2026-04-09

The primary mitigation for CVE-2026-34520 is to upgrade to aiohttp version 3.13.4 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. One approach is to sanitize incoming header values, removing or escaping control characters before processing them. Web Application Firewalls (WAFs) or reverse proxies can also be configured to filter out suspicious header values. Specifically, look for rules that block headers containing unusual control characters or unexpected sequences. After upgrading, verify the fix by sending crafted requests containing control characters in headers and confirming that the application behaves as expected, without misinterpreting the header values.