---
schema_version: '1.0'
id: security-20260714-ce6a2b
url: https://osv.dev/vulnerability/PYSEC-2026-2104
url_hash: ce6a2b9757701685578336be548e66977ddf915644b08b70e34f8aea5f985866
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2104
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-34993
- PYSEC-2026-2104
- severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- aiohttp
- PyPI
lang: en
published_at: '2026-06-02T20:16:34Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:42:55Z'
status: published
content_hash: 564abb698309e7657d3da9edcc16bd47504773e0b91c1965048fc477311ee0ee
license_note: full
summary: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
  Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow
  arbitrary code execution. Most applications using this function will be doing so
  with the user's own data, so this is
summary_source: rss
summary_en: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input
  may allow arbitrary code execution. Most applications using this function will be
  doing so with the user's own data, so this is
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-34993 — aiohttp
---

# CVE-2026-34993 — aiohttp

## TL;DR
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is

## Key Points
- cve / CVE-2026-34993 / PYSEC-2026-2104 / severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H / aiohttp / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
**Advisory:** PYSEC-2026-2104 (CVE-2026-34993)

**Affected (your watchlist):**
- `PyPI:aiohttp` 3.13.3 → fixed in 3.14.0 [docker/docker-strands]

**Details:**
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

**References:**
- https://access.redhat.com/security/cve/CVE-2026-34993
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34993.json
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:34456
- https://access.redhat.com/errata/RHSA-2026:37275
- https://bugzilla.redhat.com/show_bug.cgi?id=2484099
- https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2104_

## Source
元記事: [CVE-2026-34993 — aiohttp](https://osv.dev/vulnerability/PYSEC-2026-2104) — published 2026-06-02T20:16:34Z