Dashboard / CVE-2026-34520

CVE-2026-34520

LOW
INFO Priority: 0.01 BB Relevance: 65/100
Published: 2026-04-01 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: None
VI: Low
VA: None

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
aiohttp aiohttp < 3.13.4

References & Advisories (3)

Bug Bounty Relevance

65 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

2.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.48%
Raw Score 0.004790
Percentile 41.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00479
2026-10-28
0.00461

Intelligence Sources

nvd ref →

External Links