CVE-2026-50269: AIOHTTP Header Injection Vulnerability

CVE-2026-50269 Overview

CVE-2026-50269 affects AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. The vulnerability allows attacker-controlled input passed into multipart or payload headers to inject additional headers or modify request contents. It is classified as an HTTP Response Splitting issue [CWE-93] affecting AIOHTTP versions prior to 3.14.0. The maintainers fixed the issue in version 3.14.0 by rejecting invalid bytes in multipart and payload headers.

Critical Impact
Applications that pass user-controlled strings to MultipartWriter.append(headers=...) or Payload.headers can be manipulated by attackers to inject arbitrary HTTP headers or alter outgoing request contents.

Affected Products

AIOHTTP versions prior to 3.14.0
Python applications using MultipartWriter.append(headers=...)
Python applications using Payload.headers with untrusted input

Discovery Timeline

2026-06-22 - CVE-2026-50269 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-50269

Vulnerability Analysis

The vulnerability resides in AIOHTTP's multipart and payload header handling logic. When an application supplies untrusted strings to MultipartWriter.append(headers=...) or assigns them to Payload.headers, AIOHTTP does not validate the bytes for header-terminating sequences. An attacker who controls part of a header value can inject CRLF (\r\n) sequences to terminate the current header line and append new headers, or alter the request body boundary. This is the classic HTTP Response Splitting class of flaw [CWE-93], applied here to outbound client requests built with AIOHTTP.

Root Cause

The root cause is missing input validation on header byte content. AIOHTTP accepted header values containing control characters such as carriage return and line feed without rejecting or sanitizing them. The fix in version 3.14.0 introduces a _safe_header helper imported from aiohttp/http_writer.py into aiohttp/payload.py. The helper validates header bytes and rejects invalid characters before they are serialized into the wire format.

Attack Vector

Exploitation requires the target application to pass attacker-controlled data into AIOHTTP header constructs. The attacker submits a string containing CRLF or other reserved control bytes. AIOHTTP then writes the value verbatim into the outgoing multipart request, splitting one header into multiple headers or injecting body content. This is an unusual pattern, which limits real-world exposure and aligns with the low severity rating.

python

# Source: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8
# Patch in aiohttp/payload.py adds header validation
    parse_mimetype,
    sentinel,
)
from .http_writer import _safe_header
from .streams import StreamReader
from .typedefs import JSONBytesEncoder, JSONEncoder, _CIMultiDict

The patch wires _safe_header into the payload module so header values are validated before transmission, rejecting CRLF and other illegal bytes that enable injection.

Detection Methods for CVE-2026-50269

Indicators of Compromise

Outbound HTTP requests from Python services containing duplicate or unexpected header lines in multipart bodies.
Application logs showing user-supplied data flowing into MultipartWriter.append or Payload.headers arguments.
Web server access logs at upstream services recording malformed multipart requests originating from AIOHTTP clients.

Detection Strategies

Audit application source code for calls to MultipartWriter.append(headers=...) and direct assignment to Payload.headers where the values originate from HTTP input, query strings, or database fields.
Use software composition analysis tools to flag installed AIOHTTP versions below 3.14.0.
Inspect network traffic for CRLF sequences embedded within multipart header values leaving Python application servers.

Monitoring Recommendations

Add web application firewall rules to block HTTP request bodies and query parameters containing raw \r\n byte sequences.
Monitor dependency manifests such as requirements.txt, pyproject.toml, and poetry.lock for AIOHTTP version pinning below 3.14.0.
Enable verbose logging on outbound HTTP clients to capture full request headers during security testing.

How to Mitigate CVE-2026-50269

Immediate Actions Required

Upgrade AIOHTTP to version 3.14.0 or later in all Python services.
Identify code paths where untrusted input reaches multipart or payload headers and add explicit validation.
Review CI/CD pipelines to ensure new builds pull the patched AIOHTTP release.

Patch Information

AIOHTTP version 3.14.0 contains the fix. The patch commit bf88077ebb14f4c29924b8e8904cba20c55c28b8 introduces _safe_header validation into aiohttp/payload.py. Full details are available in the GitHub Security Advisory GHSA-m6qw-4cw2-hm4m and the upstream commit.

Workarounds

Sanitize all user-supplied strings before passing them to MultipartWriter.append(headers=...) or Payload.headers by rejecting bytes such as \r, \n, and null.
Avoid placing untrusted data into HTTP header constructs, preferring to send such data as request body fields instead.
Wrap AIOHTTP client code with an internal helper that validates header values against RFC 7230 token and field-value grammar.

bash

# Configuration example - upgrade AIOHTTP via pip
pip install --upgrade 'aiohttp>=3.14.0'

# Verify the installed version
python -c "import aiohttp; print(aiohttp.__version__)"