CVE-2026-34993

AIOHTTP Vulnerable to Deserialization of Untrusted Data

HIGH

7.3

CVSS Score

Published: June 2, 2026 at 06:29 PM UTC

Updated: September 4, 2026 at 03:36 PM UTC

10 products affected across 3 vendorsAiohttpSatelliteOpenShift AI

Using aiohttp by aio-libs?

Get instant alerts when new vulnerabilities affect aiohttp - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.3

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Aiohttp · Aiohttp

95%

v < 3.14.0

Affected range stops below 3.14.0, so it looks safe — our inference, not a vendor statement

Aiohttp · Aio Libspypi

60%

v < 3.14.0

Affected range stops below 3.14.0, so it looks safe — our inference, not a vendor statement

AI Inference Server · Red Hatcontainer

60%

All versions

Vendor states this is fixed in 1787601159 (unaffected)

Ansible Automation Platform · Red Hatrpm

60%

Vendor states this is fixed in 0:3.14.1-2.el8ap (unaffected)

Vendor states this is fixed in 0:3.14.1-2.el9ap (unaffected)

Vendor states this is fixed in 0:4.6.32-1.el8ap (unaffected)

Vendor states this is fixed in 0:4.6.32-1.el9ap (unaffected)

Vendor states this is fixed in 0:4.7.16-1.el9ap (unaffected)

Vendor states this is fixed in 1785376164 (unaffected)

Vendor states this is fixed in 1785426734 (unaffected)

Vendor states this is fixed in 1785429657 (unaffected)

Vendor states this is fixed in 1785646188 (unaffected)

Vendor states this is fixed in 1785753568 (unaffected)

Vendor states this is fixed in 1785775360 (unaffected)

Vendor states this is fixed in 2 (unaffected)

Enterprise Linux AI · Red Hatrpm

60%

Vendor states this is fixed in 1788260684 (unaffected)

Vendor states this is fixed in 1788273908 (unaffected)

Vendor states this is fixed in 1788273909 (unaffected)

Vendor states this is fixed in 1788273977 (unaffected)

Vendor states this is fixed in 1788290314 (unaffected)

Exploit Intelligence · Red Hatrpm

60%

All versions

OpenShift AI · Red Hatcontainer

60%

All versions

Vendor states this is fixed in 1780069179 (unaffected)

Vendor states this is fixed in 1780069181 (unaffected)

Vendor states this is fixed in 1780078807 (unaffected)

Vendor states this is fixed in 1780078840 (unaffected)

Vendor states this is fixed in 1782132163 (unaffected)

Vendor states this is fixed in 1782132167 (unaffected)

Vendor states this is fixed in 1782132207 (unaffected)

Vendor states this is fixed in 1782132236 (unaffected)

Vendor states this is fixed in 1782132237 (unaffected)

Vendor states this is fixed in 1782132240 (unaffected)

Vendor states this is fixed in 1782132286 (unaffected)

Vendor states this is fixed in 1782132297 (unaffected)

Vendor states this is fixed in 1782133907 (unaffected)

Vendor states this is fixed in 1782472374 (unaffected)

Vendor states this is fixed in 1782726504 (unaffected)

Vendor states this is fixed in 1782887848 (unaffected)

Vendor states this is fixed in 1783024305 (unaffected)

Vendor states this is fixed in 1783082430 (unaffected)

Vendor states this is fixed in 1783091175 (unaffected)

Vendor states this is fixed in 1783701598 (unaffected)

Vendor states this is fixed in 1786622543 (unaffected)

Vendor states this is fixed in 1786635926 (unaffected)

Vendor states this is fixed in 1787073451 (unaffected)

Vendor states this is fixed in 1787073459 (unaffected)

Vendor states this is fixed in 1787073546 (unaffected)

Vendor states this is fixed in 1787073593 (unaffected)

Vendor states this is fixed in 1787073605 (unaffected)

Vendor states this is fixed in 1787073611 (unaffected)

Vendor states this is fixed in 1787073713 (unaffected)

Vendor states this is fixed in 1787073717 (unaffected)

Vendor states this is fixed in 1787073866 (unaffected)

Vendor states this is fixed in 1787073873 (unaffected)

Vendor states this is fixed in 1787073913 (unaffected)

Vendor states this is fixed in 1787073929 (unaffected)

Vendor states this is fixed in 1787073936 (unaffected)

Vendor states this is fixed in 1787074078 (unaffected)

Vendor states this is fixed in 1787074331 (unaffected)

Vendor states this is fixed in 1787076481 (unaffected)

Vendor states this is fixed in 1787076778 (unaffected)

Vendor states this is fixed in 1787077779 (unaffected)

Vendor states this is fixed in 1787169432 (unaffected)

OpenShift Lightspeed · Red Hatrpm

60%

All versions

Satellite · Red Hatrpm

60%

Vendor states this is fixed in 0:1.3.1-5.el9pc (unaffected)

Vendor states this is fixed in 0:3.14.3-1.el8pc (unaffected)

Vendor states this is fixed in 0:3.14.3-1.el9pc (unaffected)

Vendor states this is fixed in 0:3.73.30-3.el9pc (unaffected)

Vendor states this is fixed in 1:2.16.19-1.el9sat (unaffected)

Update Infrastructure · Red Hatcontainer

60%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (26)

x_refsource_CONFIRMMitigationPatchVendor Advisory

Source: cverecord

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8

x_refsource_MISCPatch

Source: cverecord

https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00