AIOHTTP, a Python asynchronous web framework, suffered a CRLF injection flaw in multipart/payload header handling. The flaw allows an attacker to supply a crafted string for headers passed to MultipartWriter.append or Payload.headers, resulting in the insertion or alteration of HTTP headers in the outgoing request. This vulnerability can be leveraged to modify request semantics, potentially leading to request smuggling, header injection attacks, or other exploitation vectors in applications that build multipart requests with user‑controlled input.

The issue affects versions of aio‑libs' aiohttp prior to 3.14.0. Any application that directly injects user data into MultipartWriter.append headers or Payload.headers without proper validation is at risk. The fix was implemented in release 3.14.0.

The CVSS score is 2.7, indicating low severity, and the vulnerability is not listed in CISA KEV. The EPSS score is not available, suggesting limited exploitation data. Exploitation requires the application to expose multipart header construction to an attacker, a relatively uncommon scenario. Thus, while the attack surface is constrained, any exposed integration should be patched immediately.