chore(deps): update dependency aiohttp to v3.13.4 [security]#16518
Open
renovate-bot wants to merge 1 commit intogoogleapis:mainfrom
Open
chore(deps): update dependency aiohttp to v3.13.4 [security]#16518renovate-bot wants to merge 1 commit intogoogleapis:mainfrom
renovate-bot wants to merge 1 commit intogoogleapis:mainfrom
Conversation
trusted-contributions-gcf
bot
added
the
kokoro:force-run
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==3.13.3→==3.13.4GitHub Vulnerability Alerts
CVE-2026-22815
Summary
Insufficient restrictions in header/trailer handling could cause uncapped memory usage.
Impact
An application could cause memory exhaustion when receiving an attacker controlled request or response. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration.
Patch: aio-libs/aiohttp@0c2e9da
CVE-2026-34513
Summary
An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.
Impact
If an application makes requests to a very large number of hosts, this could cause the DNS cache to continue growing and slowly use excessive amounts of memory.
Patch: aio-libs/aiohttp@c4d77c3
CVE-2026-34514
Summary
An attacker who controls the
content_typeparameter in aiohttp could use this to inject extra headers or similar exploits.Impact
If an application allows untrusted data to be used for the multipart
content_typeparameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.Patch: aio-libs/aiohttp@9a6ada9
CVE-2026-34515
Summary
On Windows the static resource handler may expose information about a NTLMv2 remote path.
Impact
If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.
Patch: aio-libs/aiohttp@0ae2aa0
CVE-2026-34516
Summary
A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.
Impact
Multipart headers were not subject to the same size restrictions in place for normal headers, potentially allowing substantially more data to be loaded into memory than intended. However, other restrictions in place limit the impact of this vulnerability.
Patch: aio-libs/aiohttp@8a74257
CVE-2026-34517
Summary
For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.
Impact
If an application uses
Request.post()an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected.Patch: aio-libs/aiohttp@cbb774f
CVE-2026-34518
Summary
When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.
Impact
The Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect.
Patch: aio-libs/aiohttp@5351c98
CVE-2026-34519
Summary
An attacker who controls the
reasonparameter when creating aResponsemay be able to inject extra headers or similar exploits.Impact
In the unlikely situation that an application allows untrusted data to be used in the response's
reasonparameter, then an attacker could manipulate the response to send something different from what the developer intended.Patch: aio-libs/aiohttp@53b35a2
CVE-2026-34520
Summary
The C parser (the default for most installs) accepted null bytes and control characters is response headers.
Impact
An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example,
request.url.origin()may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.Patch: aio-libs/aiohttp@9370b97
CVE-2026-34525
Summary
Multiple Host headers were allowed in aiohttp.
Impact
Mostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using
Application.add_domain().Patch: aio-libs/aiohttp@e00ca3c
Patch: aio-libs/aiohttp@53e2e6f
Release Notes
aio-libs/aiohttp (aiohttp)
v3.13.4Compare Source
===================
Features
Added
max_headersparameter to limit the number of headers that should be read from a response -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11955.Added a
dns_cache_max_sizeparameter toTCPConnectorto limit the size of the cache -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12106.Bug fixes
Fixed server hanging indefinitely when chunked transfer encoding chunk-size
does not match actual data length. The server now raises
TransferEncodingErrorinstead of waiting forever for data that willnever arrive -- by :user:
Fridayai700.Related issues and pull requests on GitHub:
:issue:
10596.Fixed access log timestamps ignoring daylight saving time (DST) changes. The
previous implementation used :py:data:
time.timezonewhich is a constant anddoes not reflect DST transitions -- by :user:
nightcityblade.Related issues and pull requests on GitHub:
:issue:
11283.Fixed
RuntimeError: An event loop is runningerror when usingaiohttp.GunicornWebWorkeror
aiohttp.GunicornUVLoopWebWorkeron Python >=3.14.-- by :user:
Tasssadar.Related issues and pull requests on GitHub:
:issue:
11701.Fixed :exc:
ValueErrorwhen creating a TLS connection withClientTimeout(total=0)by converting0toNonebefore passing tossl_handshake_timeoutin :py:meth:asyncio.loop.start_tls-- by :user:veeceey.Related issues and pull requests on GitHub:
:issue:
11859.Restored :py:meth:
~aiohttp.BodyPartReader.decodeas a synchronous methodfor backward compatibility. The method was inadvertently changed to async
in 3.13.3 as part of the decompression bomb security fix. A new
:py:meth:
~aiohttp.BodyPartReader.decode_itermethod is now availablefor non-blocking decompression of large payloads using an async generator.
Internal aiohttp code uses the async variant to maintain security protections.
Changed multipart processing chunk sizes from 64 KiB to 256KiB, to better
match aiohttp internals
-- by :user:
bdracoand :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11898.Fixed false-positive :py:class:
DeprecationWarningfor passingenable_cleanup_closed=Trueto :py:class:~aiohttp.TCPConnectorspecifically on Python 3.12.7.-- by :user:
Robsdedude.Related issues and pull requests on GitHub:
:issue:
11972.Fixed _sendfile_fallback over-reading beyond requested count -- by :user:
bysiber.Related issues and pull requests on GitHub:
:issue:
12096.Fixed digest auth dropping challenge fields with empty string values -- by :user:
bysiber.Related issues and pull requests on GitHub:
:issue:
12097.ClientConnectorCertificateError.os_errorno longer raises :exc:AttributeError-- by :user:
themylogin.Related issues and pull requests on GitHub:
:issue:
12136.Adjusted pure-Python request header value validation to align with RFC 9110 control-character handling, while preserving lax response parser behavior, and added regression tests for Host/header control-character cases.
-- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12231.Rejected duplicate singleton headers (
Host,Content-Type,Content-Length, etc.) in the C extension HTTP parser to matchthe pure Python parser behaviour, preventing potential host-based
access control bypasses via parser differentials
-- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12240.Aligned the pure-Python HTTP request parser with the C parser by splitting
comma-separated and repeated
Connectionheader values for keep-alive,close, and upgrade handling -- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12249.Improved documentation
Documented :exc:
asyncio.TimeoutErrorforWebSocketResponse.receive()and related methods -- by :user:
veeceey.Related issues and pull requests on GitHub:
:issue:
12042.Packaging updates and notes for downstreams
Upgraded llhttp to 3.9.1 -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12069.Contributor-facing changes
The benchmark CI job now runs only in the upstream repository -- by :user:
Cycloctane.It used to always fail in forks, which this change fixed.
Related issues and pull requests on GitHub:
:issue:
11737.Fixed flaky performance tests by using appropriate fixed thresholds that account for CI variability -- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
11992.Miscellaneous internal changes
Fixed
test_invalid_idnato work withidna3.11 by using an invalid character (\u0080) that is rejected byyarlduring URL construction -- by :user:rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12027.Fixed race condition in
test_data_fileon Python 3.14 free-threaded builds -- by :user:rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12170.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.