AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
GHSA-p998-jp59-783m · CVE-2026-34515 · PYSEC-2026-2097
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Summary
On Windows the static resource handler may expose information about a NTLMv2 remote path.
Impact
If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.
Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
References
- WEB https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34515
- WEB https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
- PACKAGE https://github.com/aio-libs/aiohttp
- WEB https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4
Ready to move
Start Securing
Free, no credit card | First findings in minutes