CVE-2026-50269
Description
A flaw was found in aiohttp, an asynchronous HTTP client/server framework. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, allows an attacker to modify HTTP requests by injecting malicious input into multipart or payload headers. If an application processes user-controlled data in these headers, an attacker could potentially alter the request's content or inject new headers, leading to unintended application behavior.
Statement
This Low impact flaw in aiohttp arises from CRLF injection when applications pass untrusted, attacker-controlled input directly into MultipartWriter.append(headers=...) or Payload.headers. Exploitation is unlikely in typical Red Hat deployments unless custom applications are specifically configured to include unvalidated user input in these HTTP multipart or payload headers, potentially allowing an attacker to inject arbitrary HTTP headers.
Mitigation
Sanitize any user-controlled input before passing it to aiohttp's `MultipartWriter.append(headers=...)` or `Payload.headers` methods. Ensure that CRLF characters (carriage return and line feed) are stripped or rejected from header values.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | Low | None | N/A |
| Availability Impact | Low | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
