Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-34515

Fixed in a distro release EPSS <1%CVSS 6.6

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.

Published 2026-04-01 · CVE record · OSV

Products: aio-libs aiohttp

Fixed upstream

EcosystemPackageFixed in
PyPIaiohttp3.13.4

Distro releases

ReleasePackageFixed in
Chainguardairflow-22.11.2-r5
Chainguardairflow-33.2.1-r0
Chainguardairflow-33.1.8-r11
Chainguardairflow-core-22.11.2-r3
Chainguardauthentik-2025.122025.12.4-r3
Chainguardauthentik-2026.22026.2.1-r3
Chainguardauthentik-fips-2025.122025.12.4-r3
Chainguardauthentik-fips-2026.22026.2.1-r3
Chainguardawx24.6.1-r33
Chainguardcheckov3.2.517-r0
Chainguarddask-kubernetes2026.3.0-r3
Chainguarddatahub-ingestion1.6.0-r1
Chainguarddatahub-ingestion-fips1.5.0.1-r1
Chainguardkeep-api0.51.0-r2
Chainguardkeep-api-fips0.51.0-r2
Chainguardkserve-storage-controller0.17.0-r2
Chainguardkubeflow-pipelines-visualization-server2.16.0-r4
Chainguardlitellm1.82.3.0-r3
Chainguardmetaflow-service2.5.0-r10
Chainguardmetaflow-service-fips2.5.0-r2
Chainguardopen-webui0.8.12-r3
Chainguardpy3-cassandra-medusa0.27.1-r2
Chainguardpy3.13-scanner-test-libraries-aiohttp0.0.1-r3
Chainguardrequest-12760.27.1-r2
Chainguardtext-generation-inference3.3.7-r10
Chainguardtritonserver-backend-vllm-cuda-12.925.9.0_git20260318-r1
Chainguardtritonserver-backend-vllm-cuda-13.025.11-r3
Ubuntu 25.10python-aiohttpno fix
Wolfiairflow-33.2.1-r0
Wolfiairflow-33.1.8-r11
Wolficheckov3.2.517-r0
Wolfidask-kubernetes2026.3.0-r3
Wolfikserve-storage-controller0.17.0-r2
Wolfikubeflow-pipelines-visualization-server2.16.0-r4
Wolfiopen-webui0.8.12-r3
Wolfipy3-cassandra-medusa0.27.1-r2