VDB
CVE-2026-34515
CVE-2026-34515
PUBLISHED
CVSS 6.6 MEDIUM
Reported by github_m · Published April 1, 2026
aiohttp is fixed in 3.13.4 (PyPI)
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| aiohttp | PyPI | 3.13.4 |
| open-webui | Chainguard | 0.8.12-r3 |
| py3.13-scanner-test-libraries-aiohttp | Chainguard | 0.0.1-r3 |
| py3-aiohttp | Alpine | 3.13.5-r0 |
| tritonserver-backend-vllm-cuda-12.9 | Chainguard | 25.9.0_git20260318-r1 |
| authentik-2026.2 | Chainguard | 2026.2.1-r3 |
| kserve | Wolfi | 0.17.0-r2 |
| py3-cassandra-medusa | Chainguard | 0.27.1-r2 |
| metaflow-service | Chainguard | 2.5.0-r10 |
| kubeflow-pipelines-visualization-server | Wolfi | 2.16.0-r4 |
| tritonserver-backend-vllm-cuda-13.0 | Chainguard | 25.11-r3 |
| open-webui | Wolfi | 0.8.12-r3 |
3 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 4.0
6.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Affected products
| Vendor | Product | Versions |
|---|---|---|
| aio-libs | aiohttp | < 3.13.4 |
| chainguard | open-webui | 0 |
| chainguard | py3.13-scanner-test-libraries-aiohttp | 0 |
| alpine | py3-aiohttp | 0 |
| chainguard | tritonserver-backend-vllm-cuda-12.9 | 0 |
| chainguard | authentik-2026.2 | 0 |
| wolfi | kserve | 0 |
| chainguard | py3-cassandra-medusa | 0 |
| chainguard | metaflow-service | 0 |
| wolfi | kubeflow-pipelines-visualization-server | 0 |
| chainguard | tritonserver-backend-vllm-cuda-13.0 | 0 |
| wolfi | open-webui | 0 |
| wolfi | airflow-3 | 0 |
| PyPI | aiohttp | 0 |
| chainguard | awx | 0 |
| chainguard | checkov | 0 |
| chainguard | request-1276 | 0 |
| chainguard | dask-kubernetes | 0 |
| wolfi | checkov | 0 |
| chainguard | airflow-3 | 0 |
…and 17 more
Timeline
- Apr 1, 2026 CVE Published
- Apr 6, 2026 CVE Updated
- Apr 29, 2026 Security Advisory
- May 18, 2026 EPSS Score (30 in total, the first dated here)
- Jun 9, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-34515
vulnetix vdb fixes CVE-2026-34515Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-34515/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m x_refsource_CONFIRM
- https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d x_refsource_MISC
- https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-34515 advisory
- https://github.com/advisories/GHSA-p998-jp59-783m advisory
- https://github.com/aio-libs/aiohttp url