aiohttp: CRLF injection in multipart headers
Date: 2026-06
Affected: pip/aiohttp
Attack vector: other
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2026-50269
CWE: CWE-113
CWE-93

### Summary Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. ### Impact In the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request. ### Workaround Sanitise such user input. ----- Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8


Mitigations:

Architectural layers (MAESTRO):