Is CVE-2026-34993 in the CISA KEV catalog?

No. CVE-2026-34993 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2026-34993?

CVE-2026-34993 has a CVSS v3 base score of 6.4 (MEDIUM).

What is the EPSS score for CVE-2026-34993?

CVE-2026-34993 has an EPSS score of 0.13% (3th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2026-34993?

Upgrade python-aiohttp on debian unstable to 3.14.0-1 or later. Fixes are available for 189 affected products.

CVE & CISA-KEV Catalog

CVE-2026-34993

MEDIUM

6.4

CVSS v3

NVD

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

CWE-502Deserialization of Untrusted Data

How to fix

Remediation Available

python-aiohttpDebian

Fixed in:3.14.0-1CVE-2026-34993

registry.redhat.io/rhoai/odhRocky

Fixed in:dashboard-rhel9@sha256:34e2a0b9054b48f28e499442753f8b6fb9479b5cdc50ff049acc4a0d7a10e931_s390xRHSA-2026:24977

Fixed in:mlflow-rhel9@sha256:d5498faf0dc9be9be5e6e4e3a3229c41153f70d095c9c411e9316784783f87f3_amd64RHSA-2026:34456

Fixed in:cli-rhel9@sha256:755cc95c98526ca7115f2846b91ec45687608e6d342e31ccfc17f67176cb1eee_amd64RHSA-2026:34456

Fixed in:dashboard-rhel9@sha256:5fa86695d06f5aa16ac95ef09d886274a93984cb98fd579c3cda2858f416e3e4_amd64RHSA-2026:24977

Fixed in:trainer-rhel9@sha256:cc398bf5db6155ad8d355573416efd3cbaf972b9837474aa23640b1ab4c468b3_amd64RHSA-2026:34456

Fixed in:rhel9-operator@sha256:b555527eea760de80d7fcf1fed41e10f27025edee9a662498a7bbf9c471710b0_ppc64leRHSA-2026:24977

Fixed in:dashboard-rhel9@sha256:b73dc027ea8f60f441ee4bc10100a5557e092d98b3994527f3d173fd3d76c9b4_amd64RHSA-2026:34456

Fixed in:mlserver-rhel9@sha256:8c1b40624208de47110047696601057ad71ece4a61ef5c68e3361af966c5f516_amd64RHSA-2026:34456

Fixed in:mlflow-rhel9@sha256:50e81b47aceba75f43737ed1e0003aa4d9ec7fefd97df87b3c60592420108b49_arm64RHSA-2026:34456

Fixed in:dashboard-rhel9@sha256:3f902dd82d23d73ebee2342d2f4397d75561bd290bf50f87ac270d4aa50016c3_ppc64leRHSA-2026:34456

Fixed in:mlflow-rhel9@sha256:13bf3cfdb49a5872ec3900b50ae7d7c6bf99f8c934e0294f14806e6f3927aeb2_s390xRHSA-2026:34456

Fixed in:mlserver-rhel9@sha256:3386f393c8cf897256e7fcb33da93aac86e0ec638a025ad9337acaa7188b0048_arm64RHSA-2026:34456

Fixed in:trainer-rhel9@sha256:9b65828886a2ccd3bafc14aad316adf106178e352919177d201ed1f6dbd2b67b_s390xRHSA-2026:34456

Fixed in:rhel9-operator@sha256:6e22dbe0f802aa7f043499bc9de82b561f342826e2f06cb6ba969b6c8958ea13_s390xRHSA-2026:34456

Fixed in:rhel9-operator@sha256:abcd8c88a7fe1885d85b35afb9ddef46e3625ad5cf2493a43773a7c02b1d24bd_arm64RHSA-2026:34456

Fixed in:automl-rhel9@sha256:ad917f5c31a2fcc8b8aaa66a7ddd810f7f3000e6972e583c5bba5ab553814766_s390xRHSA-2026:34456

Fixed in:trainer-rhel9@sha256:4b7413dc4797a996756df37519397f8c6ab64b743d07ebc7192883b6edf6ba32_arm64RHSA-2026:34456

Fixed in:autorag-rhel9@sha256:60daf620603afa66fabee5deaa00b1bff499be916f5183f7a2283bdfe9470b6a_ppc64leRHSA-2026:34456

Fixed in:dashboard-rhel9@sha256:56b3db4ed55e1f30c3023da19724a46c821072226d5f15adba0de7559e28d0b0_arm64RHSA-2026:34456

Fixed in:dashboard-rhel9@sha256:6038a6aae07748c298880500284227ce61054efeef20228af49bfaa24fd56b92_s390xRHSA-2026:34456

Fixed in:dashboard-rhel9@sha256:2868a647b53478b49a2e6556aafa8c4b7d0f27baed0c03a41355f1c4217d482d_ppc64leRHSA-2026:24977

Fixed in:autorag-rhel9@sha256:dce6b5981d4b184e9f761f1ea45362bfabf00fe25756bfe0613bc9231700d874_arm64RHSA-2026:34456

Fixed in:rhel9-operator@sha256:b46b94913c4ae9611197721ed67f645570d399f2c8c75944466a0be3d061d39b_arm64RHSA-2026:24977

Fixed in:modelmesh-rhel9@sha256:547db02ccc1a2dc941ec9ee6b07195197cc96c167067fe28d6fe9d8592f7e4ce_arm64RHSA-2026:24977

Fixed in:autorag-rhel9@sha256:55f43d09fb11923d4bc334364decc4ab007b75794a969b232de6886743bd8c28_s390xRHSA-2026:34456

Fixed in:dashboard-rhel9@sha256:0225c8edaee35bc44e9991179caa5b878dcdd52243f79e21cfc39604708d714b_arm64RHSA-2026:24977

Fixed in:autorag-rhel9@sha256:14b869d2c50ae52267b4a1f3432b1eb45de19f48489a1ce119aa14ffbadfeea2_amd64RHSA-2026:34456

Fixed in:automl-rhel9@sha256:0e97b6f4559a12365d19c457180f63039f06f5233b190ad8101d1aba8857835c_ppc64leRHSA-2026:34456

Fixed in:operator-bundle@sha256:cb6c88c74e68dbc55c9c976e251da2a38bf97feb2cf3ad0719f458a98f05352a_amd64RHSA-2026:34456

Fixed in:trainer-rhel9@sha256:026d02c7eaca35351a7da3c985997aef143a4d6697ca4b50f3e3c64c3b6e40c7_ppc64leRHSA-2026:34456

Fixed in:rhel9-operator@sha256:f581e73050422bd319066446f69b34938e38df3e3e0d0bd0e6715c8f5ae01d09_s390xRHSA-2026:24977

Fixed in:rhel9-operator@sha256:eef60919ed3b223502dec72c946b5497bf1c390da1fa4c06c5359c944b11dd84_ppc64leRHSA-2026:34456

Fixed in:automl-rhel9@sha256:6cde90e9b241d61eca654a1769588c026a36f7ee378c5e1e37992c3fb5105b35_arm64RHSA-2026:34456

Fixed in:mlflow-rhel9@sha256:a1097f1d3e0e963f45acbf3b5189e743c919857134f7162e4373c72410ce1f8b_ppc64leRHSA-2026:34456

Fixed in:rhel9-operator@sha256:2ca3fdc944e80ba9028b967a8b888c8c223297b923ebf970f3b1d77b9c1db96b_amd64RHSA-2026:34456

Fixed in:automl-rhel9@sha256:81837e12dd1ee215fb18c10fefd0acb7b19479dc2eae4c1fb9c7b74834d126d4_amd64RHSA-2026:34456

Fixed in:rhel9-operator@sha256:96df2dbb928da1bf319c547653a27ea1afacb457e1871e2dda0eca85432c4801_amd64RHSA-2026:24977

Fixed in:operator-bundle@sha256:d6e42016a7fc3bfebcf2626faa3531505fa3c8eed551c20768378649cc89956a_amd64RHSA-2026:24977

Fixed in:modelmesh-rhel9@sha256:6f4c1a5f4f57eff6a234672fc225538be92be8fe8e99383060f101728a02f10a_amd64RHSA-2026:24977

Fixed in:cli-rhel9@sha256:3ee844ee5cfcd387011ade7127c7ca45022fc6dbaa1ee24b02590bf23921bf63_arm64RHSA-2026:34456

registry.redhat.io/rhoai/odhRed Hat / RHEL