CVE-2026-34993
Medium
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.
SeverityMedium
CVSS6.4
Exploit probability8. percentile0.2%
ProductAiohttp
PublishedJun 2, 2026
First seenJun 2, 2026
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- aiohttp aiohttp3.14.0 or later
- aiohttp3.14.0 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2026:59135
- access.redhat.com/errata/RHSA-2026:50319
- access.redhat.com/errata/RHSA-2026:63327
- access.redhat.com/errata/RHSA-2026:59136
- access.redhat.com/errata/RHSA-2026:50336
- access.redhat.com/errata/RHSA-2026:63387
- access.redhat.com/errata/RHSA-2026:63386
- access.redhat.com/errata/RHSA-2026:63385
- access.redhat.com/errata/RHSA-2026:59518
- access.redhat.com/errata/RHSA-2026:50357
- access.redhat.com/errata/RHSA-2026:50479
- access.redhat.com/errata/RHSA-2026:50340
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| aiohttp aiohttp | v < 3.14.0 | 3.14.0 |
| aiohttpPyPI | v < 3.14.0 | 3.14.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.