CVE-2026-50269 AIOHTTP: CRLF injection in multipart headers

What is CVE-2026-50269?

CVE-2026-50269 is a low-severity vulnerability in aio-libs aiohttp, published on 22 Jun 2026.

Official description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

Weakness: CWE-93, CWE-113

Which versions are affected by CVE-2026-50269?

3 open source packages ship an affected version, including aiohttp. It affects 1 product.

Products include Aiohttp Aiohttp.

How do I fix CVE-2026-50269?

Upgrade aiohttp to 3.14.0 or later.

Is CVE-2026-50269 being exploited?

There is no known exploitation of CVE-2026-50269 in the wild and no public exploit code.

Other vulnerabilities in aio-libs aiohttp

• CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method High 8.7
• CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb High 7.5
• CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp High 7.5
• CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version High 7.2
• CVE-2026-22815 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-90656, CLEANSTART-2026-NU42168, CLEANSTART-2026-OD07469, DEBIAN-CVE-2026-50269, ECHO-b9f2-2c14-64ab, GHSA-m6qw-4cw2-hm4m and 19 more.