Medium [CVE-2026-50269] CRLF injection in multipart headers

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.

In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

This vulnerability, known as CRLF (Carriage Return Line Feed) injection, allows an attacker to modify HTTP requests by injecting malicious input into multipart or payload headers.

If an application processes user-controlled data in these headers, an attacker could potentially alter the request's content or inject new headers, leading to unintended application behavior.

This Low impact flaw in aiohttp arises from CRLF injection when applications pass untrusted, attacker-controlled input directly into `MultipartWriter.append(headers=...)` or `Payload.headers`.

Exploitation is unlikely in typical Red Hat deployments unless custom applications are specifically configured to include unvalidated user input in these HTTP multipart or payload headers, potentially allowing an attacker to inject arbitrary HTTP headers.