CVE-2026-34519: 
Wolfi vulnerability analysis and mitigation

CVE-2026-34519 is an HTTP Response Splitting vulnerability in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response object may inject extra HTTP headers via carriage return (\r) or line feed (\n) characters. The vulnerability was discovered by DHIRAL2908 and disclosed on April 1, 2026. It affects all aiohttp versions up to and including 3.13.3, and has a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 2.7 (Low) (Github Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of CRLF sequences in HTTP headers (CWE-113) and improper validation of syntactic correctness of input (CWE-1286). Specifically, the _set_status method in web_response.py previously only checked for \n in the reason parameter, failing to reject standalone \r characters. An attacker who can supply untrusted input to the reason parameter of an aiohttp Response or HTTPException object can embed \r or \r\n sequences to inject arbitrary HTTP headers into the server's response. The fix (commit 53b35a2) extends validation in both web_response.py and web_exceptions.py to reject any reason value containing either \r or \n, and also applies the _safe_header check to the status line in the pure-Python serializer (aiohttp Security Advisory, Patch Commit).

Successful exploitation allows an attacker to inject arbitrary HTTP response headers, which can lead to cache poisoning, session fixation, cross-site scripting (XSS) via injected headers, or other header-based attacks depending on how downstream systems and clients process the manipulated response. There is no confidentiality or availability impact; the primary risk is integrity of HTTP responses. Exploitation requires the unlikely precondition that an application passes untrusted user-controlled data directly into the reason parameter of an aiohttp Response object (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.045–0.056%, placing it in a low exploitation probability tier. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a vulnerable target: Find an application using aiohttp <= 3.13.3 that passes user-controlled input (e.g., from a query parameter, form field, or request header) directly into the reason parameter of an aiohttp Response or HTTP exception object.
2. Craft a malicious payload: Construct a string containing a \r or \r\n sequence followed by a desired injected header, for example: OK\r\nSet-Cookie: evil=1 or OK\rInjected-Header: malicious-value.
3. Trigger the vulnerable code path: Submit a request to the application that causes the server to use the attacker-controlled value as the HTTP response reason phrase (e.g., via a URL parameter that is reflected into the reason field).
4. Observe injected headers: The HTTP response will contain the injected header(s) after the manipulated reason phrase, which can be used for cache poisoning, session fixation, or XSS depending on the target environment (aiohttp Security Advisory, Patch Commit).

• Network: HTTP responses from the server containing unexpected or duplicate headers (e.g., Set-Cookie, Location, or custom headers) immediately following the HTTP status reason phrase.
• Logs: Application or web server access logs showing requests with URL-encoded or raw %0d (\r) or %0a (\n) characters in parameters that are reflected into response reason fields.
• Application Behavior: Unexpected HTTP response headers observed by clients or intermediary proxies/caches that were not explicitly set by application logic.

Upgrade aiohttp to version 3.13.4 or later, which rejects any reason parameter containing \r or \n characters with a ValueError (aiohttp Release). As a workaround prior to patching, audit all application code that constructs Response or HTTP exception objects and ensure no user-controlled data is passed to the reason parameter without explicit sanitization (stripping or rejecting \r and \n). IBM products including Process Mining, API Connect, watsonx Code Assistant On Prem, and Observability with Instana (OnPrem) have also released interim fixes addressing this vulnerability (IBM Process Mining Fix, IBM API Connect).

The vulnerability was rated Low severity by the aiohttp maintainers, reflecting the narrow exploitation precondition that an application must pass untrusted data into the reason parameter — an uncommon pattern. Red Hat tracked the issue via Bugzilla and assigned medium priority. No significant public researcher commentary or media coverage beyond standard vulnerability database entries was observed (aiohttp Security Advisory, Red Hat Bugzilla).