GHSA-MWH4-6H8G-PG8W AIOHTTP has HTTP response splitting via \r in reason phrase

🗓️ 01 Apr 2026 21:48:24Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Aiohttp may allow HTTP response splitting if the reason phrase is untrusted and contains a return.

Reporter	Title	Published	Views	Family All 78
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs	3 Aug 202609:07	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	20 Jun 202612:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	5 Jun 202607:26	–	ibm
Tenable Nessus	aioHTTP < 3.13.4 Multiple Vulnerabilities (CVE-2026-22815)	3 Apr 202600:00	–	nessus
Tenable Nessus	Debian dla-4613 : python-aiohttp-doc - security update	1 Jun 202600:00	–	nessus
Tenable Nessus	SUSE SLES16 Security Update : python-aiohttp (SUSE-SU-2026:22173-1)	26 Jun 202600:00	–	nessus
Tenable Nessus	SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3059-1)	16 Jul 202600:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3207-1)	24 Jul 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-34519	3 Apr 202600:00	–	nessus
ATTACKERKB	CVE-2026-34519	1 Apr 202620:26	–	attackerkb

Source	Link
github	www.github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8w
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-34519
github	www.github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b
github	www.github.com/aio-libs/aiohttp
github	www.github.com/aio-libs/aiohttp/releases/tag/v3.13.4

13 Jul 2026 07:26Current

5.8Medium risk

Vulners AI Score5.8

CVSS 46.9

EPSS0.00292

web response splitting reason phrase untrusted data header injection aiohttp