Skip to content
fr Sign in
6.4 Medium

CVE-2026-34993 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Affected products and versions

Product Affected versions Fixed in
aiohttp 3.14 earliest → < 3.14.0 3.14.0
Red Hat OpenShift AI 2.25 1783091175 earliest → < 1783091175 1783091175
Exploit Intelligence Versions not published
Migration Toolkit for Applications 8 Versions not published
OpenShift Lightspeed Versions not published
Red Hat AI Inference Server Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat Hardened Images Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Show the 22 other branches
Product Affected versions Fixed in
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Ansible Automation Platform Ansible Core 2 Versions not published
Red Hat Discovery 2 1786638573 earliest → < 1786638573 1786638573
Red Hat Satellite 6 Versions not published
Red Hat Update Infrastructure 4 for Cloud Providers Versions not published
Red Hat OpenShift AI 3.4 1787073593 earliest → < 1787073593 1787073593
Lightspeed Core Versions not published
Red Hat OpenShift AI 3.3 1782472374 earliest → < 1782472374 1782472374
Red Hat Migration Toolkit for Applications 8.2 1784109883 earliest → < 1784109883 1784109883
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.5 1785429657 earliest → < 1785429657 1785429657
Red Hat Ansible Automation Platform 2.6 1785775360 earliest → < 1785775360 1785775360
Red Hat Ansible Automation Platform 2.7 1785426734 earliest → < 1785426734 1785426734
Red Hat AI Inference Server 3.3 1787601159 earliest → < 1787601159 1787601159
Red Hat Enterprise Linux AI 3.3 1788273977 earliest → < 1788273977 1788273977
Red Hat Satellite 6.16 for RHEL 8 Versions not published
Red Hat Satellite 6.16 for RHEL 9 Versions not published
Red Hat Satellite 6.17 for RHEL 9 Versions not published
Red Hat Satellite 6.18 for RHEL 9 Versions not published
Red Hat Satellite 6.19 for RHEL 9 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of aiohttp

The 53 CVEs of aiohttp →
CVE-2026-111750 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python 6.3 Medium CVE-2026-111749 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python 2.3 Low CVE-2026-111748 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python 6.3 Medium CVE-2026-111066 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python 8.2 High
Track this CVE