Skip to content
Fencer Vulns
high 7.2

CVE-2026-34993 json

AIOHTTP Vulnerable to Deserialization of Untrusted Data

published 2026-06-02 5 mo ago modified 2026-09-17 52 d ago also GHSA-jg22-mg44-37j8 , PYSEC-2026-2104 , EUVD-2026-34001

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Patch / fix

  • pypi aiohttp 3.14.0
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:3.14.1-2.el8ap, 0:4.6.32-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:3.14.1-2.el9ap, 0:4.6.32-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:3.14.1-2.el9ap, 0:4.7.16-1.el9ap
  • Red Hat Red Hat Satellite 6.16 for RHEL 8 0:3.14.3-1.el8pc
  • Red Hat Red Hat Satellite 6.16 for RHEL 9 0:3.14.3-1.el9pc
  • Red Hat Red Hat Satellite 6.17 for RHEL 9 0:3.14.3-1.el9pc, 1:2.16.19-1.el9sat
  • Red Hat Red Hat Satellite 6.18 for RHEL 9 0:1.3.1-5.el9pc, 0:3.14.3-1.el9pc, 0:3.73.30-3.el9pc
  • Red Hat Red Hat Satellite 6.19 for RHEL 9 0:3.14.3-1.el9pc
  • Red Hat Red Hat AI Inference Server 3.3 1787601159
  • Red Hat Red Hat Ansible Automation Platform 2.5 1785429657
  • Red Hat Red Hat Ansible Automation Platform 2.6 1785646188, 1785753568, 1785775360
  • Red Hat Red Hat Ansible Automation Platform 2.7 1785376164, 1785426734
  • Red Hat Red Hat Discovery 2 1786638573
  • Red Hat Red Hat Enterprise Linux AI 3.3 1788260684, 1788273908, 1788273909, 1788273977, 1788290314
  • Red Hat Red Hat Migration Toolkit for Applications 8.2 1784109883
  • Red Hat Red Hat OpenShift AI 2.25 1780069179, 1780069181, 1780078807, 1780078840, 1783024305, 1783082430, 1783091175, 1783701598
  • Red Hat Red Hat OpenShift AI 3.3 1782472374, 1782887848
  • Red Hat Red Hat OpenShift AI 3.4 1782132163, 1782132167, 1782132207, 1782132236, 1782132237, 1782132240, 1782132286, 1782132297, 1782133907, 1782726504, 1786622543, 1786635926, 1787073451, 1787073459, 1787073611, 1787073866, 1787073873, 1787073936, 1787076778, 1787169432
  • python-aiohttp Debian 12 3.8.4-1+deb12u2
  • python-aiohttp Debian 14 3.14.0-1

debian advisories DEBIAN-CVE-2026-34993

  • rubygem-jwt satellite utils 6.19, satellite utils 6.18, satellite utils 6.17 +9 more 2.10.3-1.el9sat
  • ansible-core satellite maintenance 6.19, satellite maintenance 6.18, satellite maintenance 6.17 +6 more 1:2.16.19-1.el9sat
  • ansible-test satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +3 more 1:2.16.19-1.el9sat
  • openvox-server satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +5 more 8.15.2-1.el9sat
  • python-aiohttp satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 3.14.3-1.el9pc
  • python3.11-aiohttp satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 3.14.3-1.el9pc
  • python3.12-aiohttp satellite capsule 6.19, satellite capsule 6.18, satellite 6.19 +1 more 3.14.3-1.el9pc
  • python3.12-gitpython satellite capsule 6.19, satellite 6.19 3.1.59-1.el9pc

red hat advisories RHSA-2026:63387RHSA-2026:63385RHSA-2026:63386RHSA-2026:63327RHSA-2026:59135RHSA-2026:59136

  • python-aiohttp SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +9 more 3.9.3-150400.10.43.1
  • python-aiohttp SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +1 more 3.6.0-150100.3.35.1
  • python-aiohttp SLES for SAP applications 16.0, SLES 16.0 3.11.16-160000.5.1

suse advisories SUSE-SU-2026:3207-1SUSE-SU-2026:3059-1SUSE-SU-2026:22173-1

  • python-aiohttp openSUSE Leap 16.0 3.11.16-160000.5.1
  • python-aiohttp openSUSE Tumbleweed 3.14.0-1.1

opensuse advisories openSUSE-SU-2026:21098-1openSUSE-SU-2026:10963-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-34993 updated cvss 7.2

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

  • Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9
    affected: workaround, no fix available
  • Red Hat AI Inference Server rhaii/vllm-tpu-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaii/vllm-gaudi-rhel9, rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9, +4 more Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-27/controller-rhel9, ansible-automation-platform-27/ee-supported-rhel9, ansible-automation-platform-25/lightspeed-chatbot-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-caikit-nlp-rhel9, rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-openvino-model-server-rhel9, rhoai/odh-ml-pipelines-runtime-generic-rhel9, rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat Satellite 6 python-aiohttp, python3-aiohttp
    affected: workaround, no fix available
  • Red Hat Update Infrastructure 4 for Cloud Providers python-aiohttp
    affected: workaround, no fix planned “Will not fix”
  • Red Hat AI Inference Server 3.3 rhaiis/model-opt-cuda-rhel9 1787601159
    fixed: vendor fix RHSA-2026:59518
  • Red Hat AI Inference Server 3.4 rhaii/vllm-cpu-rhel9 1789681128, rhaii/vllm-cpu-rhel9 1790075793, rhaii/vllm-cuda-rhel9 1789681126, rhaii/vllm-cuda-rhel9 1790090131, rhaii/vllm-rocm-rhel9 1789681126, rhaii/vllm-rocm-rhel9 1790109620, +2 more
    fixed: vendor fix RHSA-2026:69466
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/ee-supported-rhel8 1785429657
    fixed: vendor fix RHSA-2026:50357
show 18 more
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-aiohttp 3.14.1-2.el8ap, automation-controller-venv-tower 4.6.32-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-aiohttp 3.14.1-2.el9ap, automation-controller-venv-tower 4.6.32-1.el9ap
    fixed: vendor fix RHSA-2026:59135
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1785753568, ansible-automation-platform-26/lightspeed-rhel9 1785775360, ansible-automation-platform-26/lightspeed-chatbot-rhel9 1785646188
    fixed: vendor fix RHSA-2026:50479
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-aiohttp 3.14.1-2.el9ap, automation-controller-venv-tower 4.7.16-1.el9ap
    fixed: vendor fix RHSA-2026:59136
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1785376164, ansible-automation-platform-27/lightspeed-chatbot-rhel9 1785426734
    fixed: vendor fix RHSA-2026:50340
  • Red Hat Discovery 2 discovery/discovery-server-rhel9 1786638573
    fixed: vendor fix RHSA-2026:54760
  • Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-cuda-rhel9 1788260684, rhelai3/bootc-aws-cuda-rhel9 1788273908, rhelai3/bootc-gcp-cuda-rhel9 1788273977, rhelai3/disk-image-cuda-rhel9 1788290314, rhelai3/bootc-azure-cuda-rhel9 1788273909
    fixed: vendor fix RHSA-2026:62336
  • Red Hat Enterprise Linux AI 3.4 rhelai3/bootc-cuda-rhel9 1790868254, rhelai3/bootc-rocm-rhel9 1790614447, rhelai3/bootc-aws-cuda-rhel9 1790881122, rhelai3/bootc-gcp-cuda-rhel9 1790881123, rhelai3/disk-image-cuda-rhel9 1790957417, rhelai3/bootc-azure-cuda-rhel9 1790881120, +1 more
    fixed: vendor fix RHSA-2026:76150
  • Red Hat Migration Toolkit for Applications 8.2 mta/mta-solution-server-rhel9 1784109883
    fixed: vendor fix RHSA-2026:43038
  • Red Hat OpenShift AI 2.25 rhoai/odh-vllm-cuda-rhel9 1791358976, rhoai/odh-vllm-rocm-rhel9 1791282503, rhoai/odh-ta-lmes-job-rhel9 1783091175, rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-llama-stack-core-rhel9 1783701598, rhoai/odh-caikit-tgis-serving-rhel9 1783082430, +5 more
    fixed: vendor fix RHSA-2026:42644
  • Red Hat OpenShift AI 3.3 rhoai/odh-mlserver-rhel9 1782887848, rhoai/odh-kserve-storage-initializer-rhel9 1789570435, rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 1782472374, rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 1790085310, rhoai/odh-trustyai-nemo-guardrails-server-rhel9 1789570674
    fixed: vendor fix RHSA-2026:73987
  • Red Hat OpenShift AI 3.4 rhoai/odh-mlserver-rhel9 1782726504, rhoai/odh-ta-lmes-job-rhel9 1786622543, rhoai/odh-feature-server-rhel9 1791863220, rhoai/odh-llm-d-kv-cache-rhel9 1787169432, rhoai/odh-llama-stack-core-rhel9 1786635926, rhoai/odh-kserve-autogluon-server-rhel9 1791300023, +28 more
    fixed: vendor fix RHSA-2026:84734
  • Red Hat Satellite 6.16 for RHEL 8 python-aiohttp 3.14.3-1.el8pc, python3.11-aiohttp 3.14.3-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-aiohttp 3.14.3-1.el9pc, python3.11-aiohttp 3.14.3-1.el9pc
    fixed: vendor fix RHSA-2026:63327
  • Red Hat Satellite 6.17 for RHEL 9 ansible-core 2.16.19-1.el9sat, ansible-test 2.16.19-1.el9sat, python-aiohttp 3.14.3-1.el9pc, python3.11-aiohttp 3.14.3-1.el9pc
    fixed: vendor fix RHSA-2026:63387
  • Red Hat Satellite 6.18 satellite/iop-insights-engine-rhel9 1791002551, satellite/iop-vulnerability-engine-rhel9 1791340412
    fixed: vendor fix RHSA-2026:79379
  • Red Hat Satellite 6.18 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9pc, python3.12-pulpcore 3.73.30-3.el9pc, pulpcore-obsolete-packages 1.3.1-5.el9pc
    fixed: vendor fix RHSA-2026:63386
  • Red Hat Satellite 6.19 satellite/iop-insights-engine-rhel9 1790815927, satellite/iop-vulnerability-engine-rhel9 1790821217
    fixed: vendor fix RHSA-2026:74651
  • Red Hat Satellite 6.19 for RHEL 9 python3.12-aiohttp 3.14.3-1.el9pc
    fixed: vendor fix RHSA-2026:63385
  • Red Hat Lightspeed Core lightspeed-core/lightspeed-stack-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat Ansible Automation Platform 2 python-aiohttp, ansible-automation-platform-26/controller-rhel9, ansible-automation-platform-26/de-minimal-rhel9, ansible-automation-platform-26/ee-minimal-rhel9, ansible-automation-platform-27/de-minimal-rhel9, ansible-automation-platform-27/ee-minimal-rhel9, +7 more Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1785376274, ansible-automation-platform-25/gateway-rhel8 1785374193, ansible-automation-platform-25/hub-web-rhel8 1785456973, ansible-automation-platform-25/receptor-rhel8 1785373835, ansible-automation-platform-25/controller-rhel8 1785376834, ansible-automation-platform-25/de-minimal-rhel8 1785383359, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.7-1.el8ap, receptorctl 1.6.7-1.el8ap, automation-hub 4.10.17-1.el8ap, automation-hub 4.10.18-1.el8ap, python3.12-daphne 4.2.2-1.el8ap, python3.12-pyasn1 0.6.4-1.el8ap, +34 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.7-1.el9ap, receptorctl 1.6.7-1.el9ap, automation-hub 4.10.17-1.el9ap, automation-hub 4.10.18-1.el9ap, python3.12-daphne 4.2.2-1.el9ap, python3.12-pyasn1 0.6.4-1.el9ap, +34 more
    +4 more products
    Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1785780020, ansible-automation-platform-26/hub-web-rhel9 1785756951, ansible-automation-platform-26/receptor-rhel9 1785632117, ansible-automation-platform-26/mcp-tools-rhel9 1785633968, ansible-automation-platform-26/controller-rhel9 1785753810, ansible-automation-platform-26/de-minimal-rhel9 1785647559, +22 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.7-1.el9ap, molecule 26.8.0-1.el9ap, receptorctl 1.6.7-1.el9ap, ansible-lint 26.8.0-1.el9ap, python3.12-nh3 0.3.6-1.el9ap, ansible-creator 26.8.0-1.el9ap, +77 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.7-1.el10ap, molecule 26.8.0-1.el10ap, receptorctl 1.6.7-1.el10ap, ansible-lint 26.8.0-1.el10ap, python-django 5.2.17-1.el10ap, python3-django 5.2.17-1.el10ap, +13 more Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1785435970, ansible-automation-platform-27/hub-web-rhel9 1785379466, ansible-automation-platform-27/receptor-rhel9 1785389482, ansible-automation-platform-27/mcp-tools-rhel9 1785374970, ansible-automation-platform-27/controller-rhel9 1785378052, ansible-automation-platform-27/de-minimal-rhel9 1785446384, +24 more
    not affected: vulnerable code not present

14 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
CISA ADP 3.1 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
NVD 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
OSV 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L

Affected packages

ecosystem package affected fixed in
pypi aiohttp
<3.14.0
3.14.0

Affected products

  • aio-libs aiohttp
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Red Hat Satellite 6.19 for RHEL 9
  • Red Hat Red Hat AI Inference Server 3.3
  • Red Hat Red Hat Ansible Automation Platform 2.5
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Ansible Automation Platform 2.7
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Enterprise Linux AI 3.3
  • Red Hat Red Hat Migration Toolkit for Applications 8.2
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Exploit Intelligence
  • Red Hat Lightspeed Core
  • Red Hat OpenShift Lightspeed
  • Red Hat Red Hat AI Inference Server
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform Ansible Core 2
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Update Infrastructure 4 for Cloud Providers

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.