homeassistant (>=0.58.0, <=0.58.1), pyplanet (>=0.5.0, <=0.5.2) +1 more potentially affected by CVE-2026-34520 via aiohttp (2.3.2)

aiohttp PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.58.0, =0.5.0, =0.6.0, =0.6.2 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

EUVD-2026-18046

AIOHTTP's C parser llhttp accepts null bytes and control characters in response header values - header injection/security bypass...

muffin (>=0.3.3, <=0.3.7) potentially affected by CVE-2026-34520 via aiohttp (0.18.4)

aiohttp PYPI version 0.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.3, =0.3.7 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

muffin (>=0.0.105, <=0.0.106) potentially affected by CVE-2026-34520 via aiohttp (0.17.0)

aiohttp PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.105, =0.0.106 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2026-34520 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

devtools-proxy (>=0.0.2, <=0.0.3) potentially affected by CVE-2026-34520 via aiohttp (1.1.4)

aiohttp PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - devtools-proxy =0.0.2, =0.0.3 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2026-34520 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2026-34520 via aiohttp (1.1.6)

aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

iamine (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-34520 via aiohttp (0.13.1)

aiohttp PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - iamine =0.1.5, =0.1.6 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

aiohttp-cors (0.3.0), aslack (0.11.0) +1 more potentially affected by CVE-2026-34520 via aiohttp (0.20.2)

aiohttp PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiohttp-cors 0.3.0 - aslack 0.11.0 - muffin =0.5.2, =0.5.12 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

GHSA-63HF-3VF5-4WQF AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

Summary The C parser the default for most installs accepted null bytes and control characters in request headers. Impact An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, request.url.origin may return a...

geoffrey (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-34520 via aiohttp (0.6.4)

aiohttp PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - geoffrey =0.1.0, =0.1.2 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

muffin (>=0.3.0, <=0.3.2) potentially affected by CVE-2026-34520 via aiohttp (0.18.3)

aiohttp PYPI version 0.18.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.0, =0.3.2 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

interest (0.0.1) potentially affected by CVE-2026-34520 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

aiopixiv (1.0.5) potentially affected by CVE-2026-34520 via aiohttp (2.0.4)

aiohttp PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv 1.0.5 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2026-34520 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

aio-tinder (>=0.1.1, <=0.1.3), muffin (0.9.0) +3 more potentially affected by CVE-2026-34520 via aiohttp (0.22.5)

aiohttp PYPI version 0.22.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.1, =0.0.3, =0.1.0, =0.4.0 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

homeassistant (>=0.42.0, <=0.42.3) potentially affected by CVE-2026-34520 via aiohttp (2.0.5)

aiohttp PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.42.0, =0.42.3 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

homeassistant (0.42.1) potentially affected by CVE-2026-34520 via aiohttp (2.0.6)

aiohttp PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant 0.42.1 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...

botstory (0.0.63) potentially affected by CVE-2026-34520 via aiohttp (2.0.1)

aiohttp PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory 0.0.63 Source cves: CVE-2026-34520 Source advisory: OSV:GHSA-63HF-3VF5-4WQF...