CVE-2026-34993

HIGH EPSS 1.9%
Published Jun 2, 20264w ago · Modified Jun 17, 20262w ago
7.3 CVSS 3.1
High
Find Similar
Published Jun 2, 2026 4w ago
Last Modified Jun 17, 2026 2w ago

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

CVSS Details

Base Score
7.3
Exploitability
1.3
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
1.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-502 Deserialization of Untrusted Data Validation

Affected Products 1

VendorProductVersionRange
aiohttpaiohttp* <3.14.0

References 2

  • github.com https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
    Patch
  • github.com https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8
    MitigationPatchVendor Advisory

Remediation

  • github.com https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
    Patch
  • github.com https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8
    MitigationPatchVendor Advisory