CVE-2026-34525: AIOHTTP Duplicate Host Header Vulnerability
Summary
CVE-2026-34525: AIOHTTP accepts duplicate Host headers. Affects aiohttp versions < 3.13.4. Fixed in 3.13.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is a popular asynchronous HTTP client/server framework for Python, enabling developers to build web applications and services efficiently. It supports both client-side and server-side operations, making it versatile for various use cases. The framework is designed to handle asynchronous requests, allowing for high-performance applications. However, a recent vulnerability has been identified that permits the acceptance of duplicate Host headers, which could lead to security concerns when used with reverse proxies.
Vulnerability Detail
The vulnerability arises from AIOHTTP's acceptance of multiple Host headers in incoming requests. While this may not directly compromise AIOHTTP's security, it poses a risk when a reverse proxy is involved. If the proxy applies security rules based on the Host header, it may process requests differently than AIOHTTP, potentially allowing unauthorized access to privileged sub-applications when using Application.add_domain(). This discrepancy can lead to security checks being bypassed, exposing sensitive functionalities.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.4
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.13.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, it is advisable to review your application's architecture and security configurations, especially if a reverse proxy is in use, to ensure that it is not relying solely on Host headers for security.
Conclusion
In summary, the CVE-2026-34525 vulnerability in AIOHTTP allows for the acceptance of duplicate Host headers, which could lead to security issues when used with reverse proxies. It is crucial to update to version 3.13.4 or later to mitigate this risk. Regular monitoring and security reviews are recommended to maintain application integrity.
See every vulnerability recorded for aiohttp →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate level of risk.
If your application uses AIOHTTP with a reverse proxy, this vulnerability could allow unauthorized access to certain functionalities, potentially compromising your application's security.
While there are no specific workarounds, consider reviewing your security configurations and monitoring for any unusual activity until you can apply the update.
You can find more details about this vulnerability in the official GitHub advisory and the AIOHTTP repository.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
