AZL-81764 CVE-2026-34515 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4...

aioboto3 (2.2.0), aiobotocore (>=0.5.0, <=0.5.3) +56 more potentially affected by CVE-2026-34517 via aiohttp (2.3.10)

aiohttp PYPI version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 2.2.0 - aiobotocore =0.5.0, =0.8.4, =0.1.0a1, =1.0.0, =3.0.0b4, =2.0.0, =1.1.1, =1.2.1, =2.1.0, =0.8.22, =2.0.0, =2.0.13 and more Source...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2026-34513 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2026-34513 Source advisory: OSV:PYSEC-2026-2095...

muffin (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-34514 via aiohttp (0.17.3)

aiohttp PYPI version 0.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.5, =0.1.6 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

muffin (>=0.3.0, <=0.3.2) potentially affected by CVE-2026-34514 via aiohttp (0.18.3)

aiohttp PYPI version 0.18.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.0, =0.3.2 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

muffin (>=0.3.3, <=0.3.7) potentially affected by CVE-2026-34514 via aiohttp (0.18.4)

aiohttp PYPI version 0.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.3, =0.3.7 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2026-34514 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

muffin (0.5.0) potentially affected by CVE-2026-34514 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

muffin (>=0.6.0, <=0.6.1) potentially affected by CVE-2026-34514 via aiohttp (0.21.2)

aiohttp PYPI version 0.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.6.0, =0.6.1 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

aiopixiv (>=1.0.0, <=1.0.4) potentially affected by CVE-2026-34517 via aiohttp (1.1.0)

aiohttp PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv =1.0.0, =1.0.4 Source cves: CVE-2026-34517 Source advisory: OSV:PYSEC-2026-2099...

botstory (0.0.63) potentially affected by CVE-2026-34517 via aiohttp (2.0.1)

aiohttp PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory 0.0.63 Source cves: CVE-2026-34517 Source advisory: OSV:PYSEC-2026-2099...

muffin (>=0.3.3, <=0.3.7) potentially affected by CVE-2026-34517 via aiohttp (0.18.4)

aiohttp PYPI version 0.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.3, =0.3.7 Source cves: CVE-2026-34517 Source advisory: OSV:PYSEC-2026-2099...

goblin (1.0.0b1) potentially affected by CVE-2026-34517 via aiohttp (0.22.1)

aiohttp PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - goblin 1.0.0b1 Source cves: CVE-2026-34517 Source advisory: OSV:PYSEC-2026-2099...

muffin (0.5.0) potentially affected by CVE-2026-34517 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2026-34517 Source advisory: OSV:PYSEC-2026-2099...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2026-34514 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

echod (0.1.0), muffin (>=0.0.94, <=0.0.97) potentially affected by CVE-2026-34514 via aiohttp (0.16.5)

aiohttp PYPI version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - echod 0.1.0 - muffin =0.0.94, =0.0.97 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

muffin (>=0.0.46, <=0.0.52) potentially affected by CVE-2026-34514 via aiohttp (0.15.0)

aiohttp PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.46, =0.0.52 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

PYSEC-2026-2096

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the contenttype parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4...

iamine (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-34514 via aiohttp (0.13.1)

aiohttp PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - iamine =0.1.5, =0.1.6 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

interest (0.0.1) potentially affected by CVE-2026-34514 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...