muffin (>=0.6.0, <=0.6.1) potentially affected by CVE-2026-34519 via aiohttp (0.21.2)

aiohttp PYPI version 0.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.6.0, =0.6.1 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

muffin (>=0.0.46, <=0.0.52) potentially affected by CVE-2026-34519 via aiohttp (0.15.0)

aiohttp PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.46, =0.0.52 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

hdx-data-freshness (>=1.0.5, <=1.1.2), pyplanet (>=0.6.0rc1, <=0.10.5) potentially affected by CVE-2026-34519 via aiohttp (2.3.9)

aiohttp PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hdx-data-freshness =1.0.5, =0.6.0rc1, =0.10.5 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

EUVD-2026-18044

AIOHTTP has HTTP response splitting via \r in reason phrase...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2026-34519 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

aiodocker (0.7.0), aiopogo (>=1.6.0b1, <=2.0.0) +10 more potentially affected by CVE-2026-34519 via aiohttp (2.0.7)

aiohttp PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiodocker 0.7.0 - aiopogo =1.6.0b1, =0.1.0, =0.1.0, =0.42.4, =0.0.1, =0.9.6, =1.1.0, =1.3.3 Source cves: CVE-2026-34519 Source advisory:...

iamine (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-34519 via aiohttp (0.13.1)

aiohttp PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - iamine =0.1.5, =0.1.6 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

pushpull (0.0.2) potentially affected by CVE-2026-34519 via aiohttp (0.22.0)

aiohttp PYPI version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pushpull 0.0.2 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

homeassistant (>=0.42.0, <=0.42.3) potentially affected by CVE-2026-34519 via aiohttp (2.0.5)

aiohttp PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.42.0, =0.42.3 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

hassmart-homeassistant (>=0.59.2, <=0.59.2.1), homeassistant (>=0.59.0, <=0.59.2) potentially affected by CVE-2026-34519 via aiohttp (2.3.5)

aiohttp PYPI version 2.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hassmart-homeassistant =0.59.2, =0.59.0, =0.59.2 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

homeassistant (0.42.1) potentially affected by CVE-2026-34519 via aiohttp (2.0.6)

aiohttp PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant 0.42.1 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

geoffrey (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-34519 via aiohttp (0.6.4)

aiohttp PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - geoffrey =0.1.0, =0.1.2 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2026-34519 via aiohttp (1.1.6)

aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

echod (0.1.0), muffin (>=0.0.94, <=0.0.97) potentially affected by CVE-2026-34519 via aiohttp (0.16.5)

aiohttp PYPI version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - echod 0.1.0 - muffin =0.0.94, =0.0.97 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-34519 via aiohttp (2.3.0a4)

aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

muffin (>=0.3.0, <=0.3.2) potentially affected by CVE-2026-34519 via aiohttp (0.18.3)

aiohttp PYPI version 0.18.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.0, =0.3.2 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2026-34519 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2026-34519 Source...

aiopogo (>=2.0.1, <=2.1.0b0), aiosparql (>=0.0.0, <=0.10.0a3) +6 more potentially affected by CVE-2026-34519 via aiohttp (2.1.0)

aiohttp PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopogo =2.0.1, =0.0.0, =0.46.0, =0.4.0, =0.0.2, =0.4.4 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...

GHSA-MWH4-6H8G-PG8W AIOHTTP has HTTP response splitting via \r in reason phrase

Summary An attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. Impact In the unlikely situation that an application allows untrusted data to be used in the response's reason parameter, then an attacker could manipulate the...

botstory (>=0.0.33, <=0.0.37) potentially affected by CVE-2026-34519 via aiohttp (1.1.1)

aiohttp PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.33, =0.0.37 Source cves: CVE-2026-34519 Source advisory: OSV:GHSA-MWH4-6H8G-PG8W...