CVE-2026-34520: 
Wolfi vulnerability analysis and mitigation

CVE-2026-34520 is a header injection vulnerability in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. The C parser (llhttp), which is the default parser for most AIOHTTP installations, accepted null bytes and control characters in HTTP response header values prior to version 3.13.4, enabling HTTP response splitting and security bypass attacks. All AIOHTTP versions up to and including 3.13.3 are affected. The vulnerability was disclosed on April 1, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical) per Red Hat, though the GitHub Advisory Database rates it Low (2.7) under CVSS v4.0 (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of CRLF sequences and control characters in HTTP header values (CWE-113) combined with insufficient input validation (CWE-1286). The llhttp-based C parser, used by default in most AIOHTTP installs, failed to reject null bytes (\x00) and control characters (e.g., \x01–\x1f, \x7f) in response header values, violating RFC 9110 §5.5. This discrepancy between the C parser's lax behavior and the stricter pure-Python parser created a parser differential that could be exploited: for example, request.url.origin() might return a different value than the raw Host header or what a reverse proxy interpreted, enabling security bypasses. The fix (commit 9370b97) added a regex pattern [\x00-\x08\x0a-\x1f\x7f] to reject forbidden control characters in request headers while preserving lax response parser behavior, and upgraded llhttp to 3.9.1 (GitHub Advisory, Patch Commit).

Successful exploitation could allow an attacker to inject malicious headers into HTTP responses or requests processed by AIOHTTP, enabling HTTP response splitting, cache poisoning, session fixation, or redirection of users to malicious sites. The parser differential between AIOHTTP's C parser and reverse proxies could be leveraged to bypass host-based access controls, as request.url.origin() may return a value inconsistent with what the reverse proxy enforced. Confidentiality impact is assessed as none, while integrity impact is high under CVSS v3.1, reflecting the potential for unauthorized data manipulation without requiring authentication or user interaction (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.045%–0.081%, placing it in the lower percentiles for near-term exploitation likelihood. No threat actor attribution has been reported. The exploit maturity is rated "Unreported" under CVSS v4.0, indicating no known weaponization (GitHub Advisory).

1. Identify target: Locate applications using AIOHTTP ≤ 3.13.3 as an HTTP client or server, particularly those sitting behind a reverse proxy that enforces host-based access controls.
2. Craft malicious header value: Construct an HTTP response (if acting as a malicious server) or request containing a header value with embedded control characters (e.g., Host: trusted.example\x01@bad.test) that the AIOHTTP C parser accepts but other components interpret differently.
3. Exploit parser differential: Send the crafted request to the AIOHTTP application. Because the C parser does not reject the control character, request.url.origin() may resolve to a different host than what the reverse proxy enforced, potentially bypassing host-based access controls.
4. Achieve security bypass or cache poisoning: Leverage the inconsistency to inject additional headers into responses (HTTP response splitting), poison shared caches with malicious content, or redirect users to attacker-controlled resources (GitHub Advisory, Patch Commit).

• Network: HTTP requests or responses containing null bytes (\x00) or control characters (\x01–\x1f, \x7f) in header values; unexpected Host header values containing @ or embedded control characters (e.g., Host: trusted.example\x01@bad.test).
• Logs: AIOHTTP access logs showing requests with unusual or non-printable characters in header fields; discrepancies between the Host header value logged by AIOHTTP and the value logged by an upstream reverse proxy.
• Application Behavior: request.url.origin() returning a value inconsistent with the raw Host header; unexpected redirects or cache entries pointing to unrecognized domains.

The primary remediation is to upgrade AIOHTTP to version 3.13.4 or later, which rejects null bytes and control characters in request headers per RFC 9110 and upgrades the bundled llhttp library to 3.9.1 (GitHub Release, GitHub Advisory). For systems unable to patch immediately, consider implementing network-level controls (e.g., WAF rules) to filter HTTP requests and responses containing suspicious null bytes or control characters in headers. IBM has released interim fixes for affected products including IBM Process Mining, IBM API Connect, IBM Guardium Data Security Center, IBM watsonx Code Assistant On Prem, and IBM Observability with Instana (OnPrem) (IBM Process Mining Fix, IBM Instana Fix).

The advisory was published by maintainer Dreamsorcerer on April 1, 2026, with credits to reporters vmfunc and oxqnd, and remediation developer rodrigobnogueira (GitHub Advisory). Red Hat tracked the issue as low severity in Bugzilla, and multiple downstream vendors including IBM issued their own advisories addressing the vulnerability in their products. The discrepancy between the CVSS v3.1 score of 9.1 (Critical) assigned by Red Hat and the CVSS v4.0 score of 2.7 (Low) from the GitHub Advisory Database generated some discussion about scoring methodology for header injection vulnerabilities.