CVE-2026-34514: 
Wolfi vulnerability analysis and mitigation

CVE-2026-34514 is a CRLF injection vulnerability in the aiohttp asynchronous HTTP client/server framework for Python, affecting all versions up to and including 3.13.3. An attacker who controls the content_type parameter passed to aiohttp's multipart form data construction can inject carriage return (\r) and line feed (\n) characters to manipulate HTTP headers. The vulnerability was reported by researcher mingijunggrape, published on March 31, 2026, and patched in version 3.13.4. It carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 2.7 (Low) (Github Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of CRLF sequences in HTTP headers (CWE-113 / CWE-93) within the add_field() method of aiohttp/formdata.py. When an application passes untrusted user input as the content_type argument to multipart form construction, aiohttp previously set the Content-Type header directly without validating for embedded \r or \n characters, enabling HTTP Response Splitting or request manipulation. The fix (commit 9a6ada9) adds an explicit check that raises a ValueError if a newline or carriage return is detected in the content_type value before it is written into the header (aiohttp commit, Github Advisory). Exploitation requires that the application passes attacker-controlled data to the content_type parameter — it is not exploitable in applications that use only static or internally generated content type values.

Successful exploitation allows an attacker to inject arbitrary HTTP headers into multipart requests constructed by the vulnerable application, potentially enabling HTTP Response Splitting, cache poisoning, session fixation via injected Set-Cookie headers, or manipulation of downstream server behavior. There is no direct confidentiality or availability impact; the primary risk is integrity compromise of the HTTP request/response flow. The scope is limited to applications that accept untrusted input for the multipart content_type parameter (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.045% (0.000450), placing it in a very low probability tier for near-term exploitation. No threat actor attribution has been reported.

1. Identify a vulnerable target: Find an application using aiohttp <= 3.13.3 that accepts user-controlled input and passes it as the content_type argument to FormData.add_field() when constructing multipart HTTP requests.
2. Craft a malicious content_type value: Prepare a string containing CRLF sequences (e.g., text/plain\r\nX-Injected-Header: malicious-value) to be supplied as the content_type parameter.
3. Trigger the vulnerable code path: Submit the crafted input through the application's interface (e.g., an API endpoint or form) so that it is passed to add_field() without sanitization.
4. Observe injected headers: The resulting multipart HTTP request will contain the injected header(s) after the Content-Type field, potentially manipulating the behavior of the receiving server, poisoning caches, or injecting cookies into responses (aiohttp commit, Github Advisory).

• Network: Outbound HTTP multipart requests from the application server containing unexpected or duplicate headers (e.g., X-Injected-Header, extra Set-Cookie, or split response lines) in the Content-Type field of a MIME part.
• Logs: Application or proxy logs showing multipart requests where the Content-Type header value contains encoded %0d, %0a, \r, or \n characters passed as user input.
• Application Behavior: Unexpected HTTP responses with injected headers reaching downstream clients or caches; anomalous cache entries with attacker-controlled header values.

The primary remediation is to upgrade aiohttp to version 3.13.4 or later, which includes the fix in commit 9a6ada9 that rejects any content_type value containing \r or \n characters (aiohttp release). As a workaround prior to patching, developers should validate and sanitize all user-controlled input before passing it to FormData.add_field(), explicitly rejecting strings containing carriage return or line feed characters. IBM has also released interim fixes for affected products including IBM Process Mining, IBM API Connect, IBM watsonx Code Assistant On Prem, and IBM Observability with Instana (IBM Process Mining fix, IBM API Connect fix).

The vulnerability was assigned Low severity by the GitHub Advisory Database and the aiohttp maintainers, reflecting the limited impact scope (integrity only, requires attacker control of the content_type parameter). Red Hat tracked the issue as medium priority in their Bugzilla system. No significant public researcher commentary or media coverage beyond standard vulnerability database entries has been observed (Github Advisory, Red Hat Bugzilla).