VDB

CVE-2026-34993

CVE-2026-34993 PUBLISHED CVSS 6.4 MEDIUM

Reported by GitHub_M · Published June 2, 2026

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Risk Scores

CVSS 3.1
6.4
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L

Affected Products

VendorProductVersions
aio-libsaiohttp< 3.14.0
Red HatRed Hat OpenShift AI 3.41782132163, 1782132163, 1782132163
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:3.14.1-2.el9ap, 0:3.14.1-2.el9ap, 0:3.14.1-2.el9ap
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat OpenShift AI (RHOAI)
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Discovery 21786638573, 1786638573, 1786638573
Red HatRed Hat AI Inference Server
Red HatRed Hat OpenShift AI 3.41782132236, 1782132236, 1782132236
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:3.14.1-2.el9ap, 0:3.14.1-2.el9ap, 0:3.14.1-2.el9ap
Red HatRed Hat OpenShift AI (RHOAI)
chainguarddask-kubernetes-fips0, 0, 0
Red HatRed Hat Ansible Automation Platform Ansible Core 2
Red HatRed Hat AI Inference Server
chainguardpy3-vllm-cuda-13.00, 0, 0
Red HatRed Hat OpenShift AI (RHOAI)
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.16-1.el9ap
chainguardgitlab-cng-fips-18.100, 0, 0

…and 176 more

Timeline

  • Jun 2, 2026 CVE Published
  • Jun 5, 2026 EPSS Score
  • Jun 5, 2026 Security Advisory
  • Jun 10, 2026 Coalition ESS Score
  • Aug 7, 2026 EPSS Score
  • Aug 7, 2026 Distribution Patch
  • Aug 7, 2026 Security Advisory
  • Aug 7, 2026 Distribution Patch
  • Aug 7, 2026 Security Advisory
  • Aug 7, 2026 Distribution Patch
  • Aug 7, 2026 Distribution Patch
  • Aug 7, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›