AIOHTTP allows users to specify the reason phrase of an HTTP response. An attacker who can control this value can embed a carriage return character, causing the server to split the response and inject additional headers. This attack can manipulate downstream client behavior or redirect traffic, but does not provide direct code execution or system compromise. The weakness aligns with HTTP response splitting (CWE‑113) and improper taint checking (CWE‑1286).

The vulnerability affects the aio-libs aiohttp asynchronous HTTP framework for Python, versions prior to 3.13.4. Any deployment using these older releases and constructing custom Response objects with user-supplied reason strings is susceptible.

The official CVSS score is 2.7, indicating low severity, and no EPSS score is published. It is not listed in CISA’s KEV catalog. Exploitation requires control over the reason parameter, which typically means the attacker must be able to influence the code that creates the Response object. Once the parameter is controlled, the attack can be performed over the network if the server exposes the vulnerable endpoint.