---
schema_version: '1.0'
id: security-20260714-ad7e36
url: https://osv.dev/vulnerability/PYSEC-2026-2106
url_hash: ad7e36ee399b9ec61596e17c3a80da1741c69412c653d599656b6e3981488a7e
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2106
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-50269
- PYSEC-2026-2106
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- aiohttp
- PyPI
lang: en
published_at: '2026-06-22T18:16:42Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:42:55Z'
status: published
content_hash: eb262588d686432cd869987a919fab7f51dc5e3af3037db4785bc47725159474
license_note: full
summary: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
  Prior to 3.14.0, attacker-controlled input included into multipart/payload headers
  can be used to modify a request to inject additional headers or similar. In the
  unlikely situation that an applicatio
summary_source: rss
summary_en: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload
  headers can be used to modify a request to inject additional headers or similar.
  In the unlikely situation that an applicatio
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-50269 — aiohttp
---

# CVE-2026-50269 — aiohttp

## TL;DR
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an applicatio

## Key Points
- cve / CVE-2026-50269 / PYSEC-2026-2106 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H / aiohttp / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** PYSEC-2026-2106 (CVE-2026-50269)

**Affected (your watchlist):**
- `PyPI:aiohttp` 3.13.3 → fixed in 3.14.0 [docker/docker-strands]

**Details:**
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

**References:**
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m
- https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2106_

## Source
元記事: [CVE-2026-50269 — aiohttp](https://osv.dev/vulnerability/PYSEC-2026-2106) — published 2026-06-22T18:16:42Z