new file mode 100644
@@ -0,0 +1,65 @@
+From b3aca47a956826116930a59e482953cacf78830a Mon Sep 17 00:00:00 2001
+From: Sam Bull <git@sambull.org>
+Date: Sat, 21 Feb 2026 00:17:11 +0000
+Subject: [PATCH] Fix multipart injection (#12104) (#12110)
+
+CVE: CVE-2026-34514
+Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06]
+
+(cherry picked from commit dab9e879be5606682a39b9dd378900eba0afd1a4)
+
+Co-authored-by: mingi jung <mingijung.grape@gmail.com>
+(cherry picked from commit 9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ aiohttp/formdata.py | 5 +++++
+ tests/test_formdata.py | 16 +++++++++++-----
+ 2 files changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/aiohttp/formdata.py b/aiohttp/formdata.py
+index 2b75b3de7..c14ada176 100644
+--- a/aiohttp/formdata.py
++++ b/aiohttp/formdata.py
+@@ -79,6 +79,11 @@ class FormData:
+ raise TypeError(
+ "content_type must be an instance of str. " "Got: %s" % content_type
+ )
++ if "\r" in content_type or "\n" in content_type:
++ raise ValueError(
++ "Newline or carriage return detected in headers. "
++ "Potential header injection attack."
++ )
+ headers[hdrs.CONTENT_TYPE] = content_type
+ self._is_multipart = True
+ if content_transfer_encoding is not None:
+diff --git a/tests/test_formdata.py b/tests/test_formdata.py
+index 4bb8aa075..9e331515c 100644
+--- a/tests/test_formdata.py
++++ b/tests/test_formdata.py
+@@ -46,12 +46,18 @@ def test_invalid_formdata_params2() -> None:
+ FormData("as") # 2-char str is not allowed
+
+
+-def test_invalid_formdata_content_type() -> None:
++@pytest.mark.parametrize("val", (0, 0.1, {}, [], b"foo"))
++def test_invalid_type_formdata_content_type(val: object) -> None:
+ form = FormData()
+- invalid_vals = [0, 0.1, {}, [], b"foo"]
+- for invalid_val in invalid_vals:
+- with pytest.raises(TypeError):
+- form.add_field("foo", "bar", content_type=invalid_val)
++ with pytest.raises(TypeError):
++ form.add_field("foo", "bar", content_type=val) # type: ignore[arg-type]
++
++
++@pytest.mark.parametrize("val", ("\r", "\n", "a\ra\n", "a\na\r"))
++def test_invalid_value_formdata_content_type(val: str) -> None:
++ form = FormData()
++ with pytest.raises(ValueError):
++ form.add_field("foo", "bar", content_type=val)
+
+
+ def test_invalid_formdata_filename() -> None:
+--
+2.44.4
+
@@ -17,6 +17,7 @@ SRC_URI += "file://CVE-2024-52304.patch \
file://CVE-2025-69227.patch \
file://CVE-2025-69223.patch \
file://CVE-2026-22815.patch \
+ file://CVE-2026-34514.patch \
"
PYPI_PACKAGE = "aiohttp"