CVE-2026-50269: AIOHTTP: CRLF injection in multipart headers
Summary
Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.
Impact
In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request.
Workaround
Sanitise such user input.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.0 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.0Patch bf88077ebb14f4c29924b8e8904cba20c55c28b8 - Configuration
If your application passes user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, sanitise those inputs to prevent CRLF injection in multipart/payload headers.
aiohttp MultipartWriter/Payload headers user input handling for multipart/payload headers = sanitise user-controlled strings before passing them to MultipartWriter.append(headers=...) or Payload.headers
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50269?
CVE-2026-50269 is classified with a risk score of 23.
What is the nature of the vulnerability in CVE-2026-50269?
CVE-2026-50269 involves attacker-controlled input in multipart/payload headers, which can lead to CRLF injection.
How can CVE-2026-50269 be mitigated?
To mitigate CVE-2026-50269, ensure that user inputs are properly validated and sanitized before being included in header fields.
Which software is affected by CVE-2026-50269?
CVE-2026-50269 affects the pip/aiohttp software library.
Is there an official fix for CVE-2026-50269?
Yes, updates and patches addressing CVE-2026-50269 should be released alongside newer versions of the affected software.