The vulnerability stems from insufficient sanitization of the content_type parameter when aiohttp constructs multipart part content type headers. An attacker who can control this value can inject CRLF sequences, enabling the addition of arbitrary HTTP headers to the response. This header injection could alter response behavior or support further attacks, though it does not grant direct code execution. The weakness aligns with CWE‑113 and CWE‑93, which describe header injection and the use of untrusted data in render contexts.

The affected product is aio-libs aiohttp. All releases before version 3.13.4 contain the flaw; upgrading to 3.13.4 or a newer release fixes the issue.

The CVSS score of 2.7 indicates low severity, and the vulnerability is not listed in the KEV catalog. EPSS data is unavailable, suggesting limited widespread exploitation. The likely attack vector is remote: an adversary who can supply or influence the content_type parameter in multipart requests can exploit the flaw. Successful exploitation requires such control; otherwise the risk remains low but non‑negligible.