2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50269

CVE-2026-50269: aiohttp: CRLF injection in multipart headers

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50269

CVE-2026-50269:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
aiohttp	pip	<= 3.13.5	3.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a CRLF injection in the aiohttp library, specifically within the handling of multipart payload headers. The analysis of the provided patch bf88077ebb14f4c29924b8e8904cba20c55c28b8 reveals that the _binary_headers property within the Payload class in aiohttp/payload.py was modified. Previously, this property constructed the raw header string by concatenating keys and values from the self.headers dictionary without any validation. This allowed for CRLF characters to be injected if they were present in the user-supplied header data. The fix involves wrapping the header keys and values with the _safe_header function, which presumably sanitizes the input and removes or escapes any malicious characters. The vulnerability could be triggered when an application uses MultipartWriter.append(headers=...) or directly manipulates Payload.headers with untrusted input. The Payload._binary_headers property is the exact location where the vulnerable code resided, making it the key runtime indicator for this vulnerability.

Vulnerable functions

Payload._binary_headers

aiohttp/payload.py

The `_binary_headers` property of the `Payload` class was responsible for creating the binary representation of the payload's headers. Before the patch, it directly concatenated header keys and values without sanitization. This allowed an attacker to inject CRLF sequences (`\r\n`) into the headers by providing malicious input in the `headers` dictionary of a `Payload` object. This could lead to HTTP request smuggling or other header-based attacks. The patch fixes this by using the `_safe_header` function to validate and sanitize both header keys and values, preventing the injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.