CVE-2026-128124

The AIOHTTP asynchronous HTTP framework for Python and asyncio is vulnerable to an event loop stall in the Application.add_domain() function. Prior to version 3.14.4 , the framework converts asterisk wildcards into greedy regular-expression fragments. When a domain mask contains two or more wildc...

GHSA-C427-H43C-VF67 AIOHTTP accepts duplicate Host headers

Summary Multiple Host headers were allowed in aiohttp. Impact Mostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly...