The vulnerability in AIOHTTP's default C parser allows the inclusion of null bytes and control characters in response header values, enabling header injection and potential security bypass. This improper handling of header data aligns with CWE‑113 (HTTP Response Splitting) and CWE‑1286 (Control characters in header values), and can lead to protocol manipulation or unintended response behavior.

AIOHTTP releases prior to version 3.13.4 are affected when using the default C parser. This applies to all installations that rely on the C based parser for HTTP response parsing.

With a CVSS score of 2.7, the vulnerability carries a low impact assessment and no publicly available EPSS data suggests widespread exploitation. Attackers could remotely craft responses containing null or control characters, but success relies on the vulnerable parser and does not typically lead to high‑severity outcomes unless combined with other weaknesses.