---
schema_version: '1.0'
id: security-20260711-948d77
url: https://osv.dev/vulnerability/GHSA-m5qp-6w8w-w647
url_hash: 948d773435265dc1ac26b90cbe2035c0907aa0f1aa5bfaa6b4624ddec2ab2555
canonical_url: https://osv.dev/vulnerability/GHSA-m5qp-6w8w-w647
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-34516
- GHSA-m5qp-6w8w-w647
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- aiohttp
- PyPI
lang: en
published_at: '2026-04-01T21:43:07Z'
fetched_at: '2026-07-11T06:37:17Z'
updated_at: '2026-07-11T06:38:28Z'
status: published
content_hash: d3493f4e0a2cfe2cc5b2455eee8de3e49aaca986b57a3c61275021284e06bdd4
license_note: full
summary: AIOHTTP has a Multipart Header Size Bypass
summary_source: rss
summary_en: AIOHTTP has a Multipart Header Size Bypass
entities:
- name: HashTag
  type: concept
- name: Link Header
  type: artifact
key_facts: []
related: []
related_auto:
- name: SustainableQuantumComputing
  type: concept
  weight: 3.0
- name: /well-known
  type: location
  weight: 1.0
title: 'CVE-2026-34516: AIOHTTP has a Multipart Header Size Bypass'
---

# CVE-2026-34516: AIOHTTP has a Multipart Header Size Bypass

## TL;DR
AIOHTTP has a Multipart Header Size Bypass

## Key Points
- cve / CVE-2026-34516 / GHSA-m5qp-6w8w-w647 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H / aiohttp / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** GHSA-m5qp-6w8w-w647 (CVE-2026-34516)

**Affected (your watchlist):**
- `PyPI:aiohttp` 3.13.3 → fixed in 3.13.4 [docker/docker-strands]

**Details:**
### Summary

A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.

### Impact

Multipart headers were not subject to the same size restrictions in place for normal headers, potentially allowing substantially more data to be loaded into memory than intended. However, other restrictions in place limit the impact of this vulnerability.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f

**References:**
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m5qp-6w8w-w647
- https://nvd.nist.gov/vuln/detail/CVE-2026-34516
- https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f
- https://github.com/aio-libs/aiohttp
- https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-m5qp-6w8w-w647_

## Source
元記事: [CVE-2026-34516: AIOHTTP has a Multipart Header Size Bypass](https://osv.dev/vulnerability/GHSA-m5qp-6w8w-w647) — published 2026-04-01T21:43:07Z