CVE-2026-34993
📛 CVE Title
AIOHTTP Vulnerable to Deserialization of Untrusted Data
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- GitHub_M
- CVSS severity
- MEDIUM
- CVSS score
- 6.4 / 10
- CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L- Effective score
- 6.4 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-502 - Reserved
- 2026-03-31
- Published
- 2026-06-02 18:29 UTC
- Last updated
- 2026-06-03 14:08 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/34xxx/CVE-2026-34993.json
- Linked Threat
- CVE-2026-34993 — CVE-2026-34993
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-06-02 20:16:34 UTC
- NVD last modified
- 2026-07-15 02:20:39 UTC
- NVD CVSS v3.1
- 6.4 / 10 MEDIUM source: security-advisories@github.com
- NVD CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L- Exploitability subscore
- 0.6 / 10
- Impact subscore
- 5.3 / 10
- EPSS score
- 0.0013 (probability of exploitation in next 30 days)
- EPSS percentile
- 2.85% vs all CVEs — higher = more likely to be exploited, as of 2026-07-16
NVD / KEV / EPSS data refreshed 2026-07-17 12:00 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-34001 - Assigner
- GitHub_M
- Published
- Jun 2, 2026, 6:29:15 PM
- Updated
- Jul 22, 2026, 12:08:44 PM
- EUVD base score (CVSS 3.1)
-
6.4 / 10
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L - EUVD-reported EPSS
- 0.1400
- Vendors
- aio-libs
- Products
-
aiohttp (< 3.14.0)
- Aliases
-
GHSA-jg22-mg44-37j8
ENISA description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| aio-libs | aiohttp |
< 3.14.0 (affected)
|
— |
Affected products — CPE 2.3 (1) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (5)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00 tenable:github.com
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8 tenable:github.com
- https://nvd.nist.gov/vuln/detail/CVE-2026-34993 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-34993 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
NVD-tagged references (8)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00 security-advisories@github.com Patch
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8 security-advisories@github.com MitigationPatchVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:24977 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:34456 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:37275 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/security/cve/CVE-2026-34993 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://bugzilla.redhat.com/show_bug.cgi?id=2484099 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34993.json 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Remediations (19)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:app.opencve.io
Affected Systems The vulnerability affects the aio-libs aiohttp package for all releases before 3.14.0. Applications that invoke CookieJar.load () with data that could be supplied by a user, such as uploaded files or user‑controlled configuration, are at risk. In many deployments, CookieJar.load () is only used with the application's own data, which reduces exposure, but if the application ...
2026-06-08 15:53 UTC -
web:blog.qualys.com
May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy…
2026-06-08 15:53 UTC -
web:cybersecuritynews.com
Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.
2026-06-08 15:53 UTC -
web:nvd.nist.gov
An official website of the United States government Here's how you know
2026-06-08 15:53 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-06-08 15:53 UTC -
web:vulert.com
Learn about CVE-2026-34993 , a vulnerability in AIOHTTP that allows deserialization of untrusted data, and how to mitigate it effectively.
2026-06-08 15:53 UTC -
web:www.anavem.com
KB5093998 is a June 2026 security update that addresses multiple critical vulnerabilities in Windows 11 Version 23H2, including CVE - 2026 -0234 in Windows Kernel and CVE - 2026 -0235 in Windows Graphics Component.
2026-06-08 15:53 UTC -
web:www.malwarebytes.com
The KEV catalog tracks vulnerabilities known to be exploited in the wild and sets patch deadlines for Federal Civilian Executive Branch (FCEB) agencies. Five of the added vulnerabilities are quite old by vulnerability standards. Patches were released in 2008, 2009, and 2010. But the Microsoft Defender vulnerabilities are from this year. Those ...
2026-06-08 15:53 UTC -
web:www.rapid7.com
Microsoft is publishing 137 vulnerabilities on May 2026 Patch Tuesday, including critical RCE in Netlogon and the Windows DNS client.
2026-06-08 15:53 UTC -
web:www.securityweek.com
Microsoft on Tuesday pushed out patches for at least 66 security defects across the Windows ecosystem and called urgent attention to a WebDAV remote code execution bug that's already been exploited in the wild. The WebDAV (Web Distributed Authoring and Versioning) flaw, marked as 'important' with a CVSS score of 8.8/10, allows browser-based drive-by downloads if a target clicks on a ...
2026-06-08 15:53 UTC -
web:cybersecuritynews.com
Microsoft has officially acknowledged a critical zero-day vulnerability in Microsoft Defender, publicly dubbed "RoguePlanet," and confirmed it is actively developing a security patch to address the flaw.
2026-06-19 02:33 UTC -
web:support.microsoft.com
Applies to: Windows Server 2019 This security update includes fixes and quality improvements that are part of the following update: May 12, 2026—KB5087538 (OS Build 17763.8755) The following is a summary of the issues that this update addresses when you install this update. The bold text within the brackets indicates the item or area of the change we are documenting. [Secure Boot] This ...
2026-06-19 02:33 UTC -
web:vulners.com
In CVE-2026-34993 , AIOHTTP prior to 3.14.0 is vulnerable: using CookieJar.load() with untrusted input may lead to arbitrary code execution. The issue stems from deserializing untrusted data in the cookie jar. The advisory notes that most applicati...
2026-06-19 02:33 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's March 2026 Patch Tuesday with security updates for 79 flaws, including 2 publicly disclosed zero-day vulnerabilities.
2026-06-19 02:33 UTC -
web:www.computerworld.com
Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...
2026-06-19 02:33 UTC -
web:www.computerworld.com
Microsoft says it is considering a patch for a zero-day vulnerability, dubbed YellowKey, that allows attackers with access to a Windows device to bypass Bitlocker encryption protection and read ...
2026-06-19 02:33 UTC -
web:www.malwarebytes.com
Microsoft says it's working on a fix for an unpatched Defender vulnerability that can give attackers the highest level of access on Windows.
2026-06-19 02:33 UTC -
web:www.rapid7.com
Microsoft is publishing 200 vulnerabilities on June 2026 Patch Tuesday, including an HTTP/2 denial of service vulnerability and an elevation of privilege vulnerability in PowerToys.
2026-06-19 02:33 UTC -
web:www.veeam.com
When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information.
2026-06-19 02:33 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-34993.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34993",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T13:59:36.320581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T14:08:22.635Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "aiohttp",
"vendor": "aio-libs",
"versions": [
{
"status": "affected",
"version": "< 3.14.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-02T18:29:15.847Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00"
}
],
"source": {
"advisory": "GHSA-jg22-mg44-37j8",
"discovery": "UNKNOWN"
},
"title": "AIOHTTP Vulnerable to Deserialization of Untrusted Data"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34993",
"datePublished": "2026-06-02T18:29:15.847Z",
"dateReserved": "2026-03-31T19:38:31.618Z",
"dateUpdated": "2026-06-03T14:08:22.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}