The vulnerability in aiohttp allows an attacker to send HTTP requests containing multiple Host headers. The server accepts and processes all header instances rather than rejecting duplicates, creating ambiguity in request handling. This weakness, identified as CWE-20 (Improper Input Validation) and CWE-444 (URL Filtering Weaknesses), can enable an attacker to manipulate the perceived target host of a request, potentially resulting in request smuggling, service degradation, or unintended data disclosure.

This flaw exists in the aio-libs aiohttp asynchronous HTTP framework. Any installation running a version earlier than 3.13.4 is affected. The official fix is provided in the aiohttp release 3.13.4, so systems using older releases should be patched to that version or newer.

With a CVSS score of 6.3 the vulnerability is considered moderate in severity. The EPSS score is not reported and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmed exploitation data. However, the attack vector is network based; an adversary only needs the ability to send a specially crafted HTTP request to a reachable aiohttp service, which makes exploitation reasonably likely for publicly exposed instances. The lack of privileged requirements further raises the practical risk for affected environments.