CVE-2026-34515 AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

What is CVE-2026-34515?

CVE-2026-34515 is a medium-severity server-side request forgery vulnerability in aio-libs aiohttp, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.

Weakness: CWE-918, CWE-36

Which versions are affected by CVE-2026-34515?

3 open source packages ship an affected version, including aiohttp. It affects 1 product.

Products include Aiohttp Aiohttp.

How do I fix CVE-2026-34515?

Upgrade aiohttp to 3.13.4 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-34515 being exploited?

There is no known exploitation of CVE-2026-34515 in the wild and no public exploit code.

Other vulnerabilities in aio-libs aiohttp

• CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method High 8.7
• CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb High 7.5
• CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp High 7.5
• CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version High 7.2
• CVE-2026-22815 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-81764, CLEANSTART-2026-BU01297, CLEANSTART-2026-ZO83290, ECHO-58cd-5f76-d131, GHSA-p998-jp59-783m, MINI-9vc6-8r8p-c326 and 9 more.