Multiple Vulnerabilities in Aiohttp (CVE-2026)

AIOHTTP's C parser (llhttp) accepted null bytes and control characters in response header values. An attacker could send crafted header values that are interpreted differently than expected, potentially leading to security bypass.

AIOHTTP allowed multiple Host headers in requests. If a reverse proxy relies on the Host header for security rules, AIOHTTP and the proxy could process different hostnames, potentially bypassing security checks.

An attacker controlling the `reason` parameter when creating a `Response` could inject extra headers. This could allow manipulation of the response to send something different from what the developer intended.

A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.

Insufficient restrictions in header/trailer handling could cause uncapped memory usage. An attacker-controlled request or response could exhaust memory resources.

AIOHTTP reads entire multipart form fields into memory before checking `client_max_size`. An attacker can send a crafted multipart request to force significant temporary memory allocation, even if the request is rejected.

When following redirects to a different origin, AIOHTTP drops the Authorization header but retains the Cookie and Proxy-Authorization headers. This could leak sensitive information.

An unbounded DNS cache could result in excessive memory usage, potentially leading to a DoS situation. Applications making requests to a very large number of hosts are most at risk.

On Windows, the static resource handler may expose information about an NTLMv2 remote path, potentially leading to credential theft or local file reads.

An attacker controlling the `content_type` parameter in AIOHTTP could use this to inject extra headers or similar exploits, manipulating the request to send unintended data.