PYSEC-2026-2103

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4...

scriptworker (0.2.1) potentially affected by CVE-2026-34525 via aiohttp (0.22.0a0)

aiohttp PYPI version 0.22.0a0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - scriptworker 0.2.1 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2026-34525 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

aio-tinder (>=0.1.1, <=0.1.3), muffin (0.9.0) +3 more potentially affected by CVE-2026-34525 via aiohttp (0.22.5)

aiohttp PYPI version 0.22.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.1, =0.0.3, =0.1.0, =0.4.0 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

aiopixiv (>=1.0.0, <=1.0.4) potentially affected by CVE-2026-34525 via aiohttp (1.1.0)

aiohttp PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv =1.0.0, =1.0.4 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

muffin (0.5.0) potentially affected by CVE-2026-34525 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

muffin (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-34525 via aiohttp (0.17.3)

aiohttp PYPI version 0.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.5, =0.1.6 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

muffin (>=0.0.105, <=0.0.106) potentially affected by CVE-2026-34525 via aiohttp (0.17.0)

aiohttp PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.105, =0.0.106 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2026-34525 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

muffin (>=0.3.3, <=0.3.7) potentially affected by CVE-2026-34525 via aiohttp (0.18.4)

aiohttp PYPI version 0.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.3, =0.3.7 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

muffin (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-34525 via aiohttp (0.17.4)

aiohttp PYPI version 0.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.2.0, =0.2.1 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

aiourlshortener (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-34525 via aiohttp (2.0.2)

aiohttp PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiourlshortener =0.0.1, =0.0.2 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2026-34525 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

homeassistant (>=0.58.0, <=0.58.1), pyplanet (>=0.5.0, <=0.5.2) +1 more potentially affected by CVE-2026-34525 via aiohttp (2.3.2)

aiohttp PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.58.0, =0.5.0, =0.6.0, =0.6.2 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

aiohttp-cors (0.3.0), aslack (0.11.0) +1 more potentially affected by CVE-2026-34525 via aiohttp (0.20.2)

aiohttp PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiohttp-cors 0.3.0 - aslack 0.11.0 - muffin =0.5.2, =0.5.12 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

aioboto3 (2.2.0), aiobotocore (>=0.5.0, <=0.5.3) +56 more potentially affected by CVE-2026-34525 via aiohttp (2.3.10)

aiohttp PYPI version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 2.2.0 - aiobotocore =0.5.0, =0.8.4, =0.1.0a1, =1.0.0, =3.0.0b4, =2.0.0, =1.1.1, =1.2.1, =2.1.0, =0.8.22, =2.0.0, =2.0.13 and more Source...

devtools-proxy (>=0.0.2, <=0.0.3) potentially affected by CVE-2026-34525 via aiohttp (1.1.4)

aiohttp PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - devtools-proxy =0.0.2, =0.0.3 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

muffin (>=0.0.23, <=0.0.45) potentially affected by CVE-2026-34525 via aiohttp (0.14.4)

aiohttp PYPI version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.23, =0.0.45 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

muffin (>=0.10.0, <=0.10.2), mutaprops (>=0.6.0, <=0.6.1) potentially affected by CVE-2026-34525 via aiohttp (1.0.2)

aiohttp PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.10.0, =0.6.0, =0.6.1 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

0x20bf (0.0.1), 2keys (0.5.1) +3262 more potentially affected by CVE-2026-34525 via aiohttp (>=3.0.0b0, <=3.13.3)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 - ab-data-processing 0.0.1 and more Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...