new file mode 100644
@@ -0,0 +1,166 @@
+From a8ea4a13b9691357fdc7796506b0c85566ed1985 Mon Sep 17 00:00:00 2001
+From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com>
+Date: Thu, 28 May 2026 23:57:41 +0100
+Subject: [PATCH] [PR #12719/879d48d1 backport][3.14] Reject invalid bytes in
+ multipart/payload headers (#12720)
+
+**This is a backport of PR #12719 as merged into master
+(879d48d1619b9bc3662037afcb8bfa790a205e9b).**
+
+CVE: CVE-2026-50269
+Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8]
+
+Backport Changes:
+- Backported the pure-Python http_writer._safe_header()
+ control-character validation from prerequisite commit
+ 1e3ecd48ec423c1fcc729c98adff31172faae1ef because aiohttp
+ 3.9.5 rejects only CR/LF and the upstream CVE regression test
+ also requires NUL rejection.
+- Adapted the prerequisite regression coverage to test _safe_header()
+ directly using the aiohttp 3.9.5 test layout. Omitted its C
+ serializer, threat-model, changelog, and broader serializer-test
+ changes because Payload._binary_headers invokes the pure-Python
+ helper directly.
+
+Co-authored-by: Sam Bull <git@sambull.org>
+(cherry picked from commit 1e3ecd48ec423c1fcc729c98adff31172faae1ef)
+(cherry picked from commit bf88077ebb14f4c29924b8e8904cba20c55c28b8)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ CHANGES/12706.bugfix.rst | 1 +
+ aiohttp/http_writer.py | 10 ++++++++--
+ aiohttp/payload.py | 8 +++++---
+ tests/test_http_writer.py | 19 +++++++++++++++++++
+ tests/test_payload.py | 15 +++++++++++++++
+ 5 files changed, 48 insertions(+), 5 deletions(-)
+ create mode 100644 CHANGES/12706.bugfix.rst
+
+diff --git a/CHANGES/12706.bugfix.rst b/CHANGES/12706.bugfix.rst
+new file mode 100644
+index 000000000..9248585f9
+--- /dev/null
++++ b/CHANGES/12706.bugfix.rst
+@@ -0,0 +1 @@
++Fixed invalid bytes being allowed in multipart/payload headers -- by :user:`Dreamsorcerer`.
+diff --git a/aiohttp/http_writer.py b/aiohttp/http_writer.py
+index 37cdc06e6..9573768f6 100644
+--- a/aiohttp/http_writer.py
++++ b/aiohttp/http_writer.py
+@@ -1,6 +1,7 @@
+ """Http related parsers and protocol."""
+
+ import asyncio
++import re
+ import zlib
+ from typing import Any, Awaitable, Callable, NamedTuple, Optional, Union # noqa
+
+@@ -171,10 +172,15 @@ class StreamWriter(AbstractStreamWriter):
+ await self._protocol._drain_helper()
+
+
++# https://www.rfc-editor.org/info/rfc9110/#section-5.5-5
++# https://www.rfc-editor.org/info/rfc9112/#section-4-3
++_FORBIDDEN_HEADER_CHARS_RE = re.compile(r"[\x00-\x08\x0a-\x1f\x7f]")
++
++
+ def _safe_header(string: str) -> str:
+- if "\r" in string or "\n" in string:
++ if _FORBIDDEN_HEADER_CHARS_RE.search(string) is not None:
+ raise ValueError(
+- "Newline or carriage return detected in headers. "
++ "Forbidden control character detected in headers. "
+ "Potential header injection attack."
+ )
+ return string
+diff --git a/aiohttp/payload.py b/aiohttp/payload.py
+index 6593b05c6..77caf520c 100644
+--- a/aiohttp/payload.py
++++ b/aiohttp/payload.py
+@@ -33,6 +33,7 @@ from .helpers import (
+ parse_mimetype,
+ sentinel,
+ )
++from .http_writer import _safe_header
+ from .streams import StreamReader
+ from .typedefs import JSONEncoder, _CIMultiDict
+
+@@ -180,9 +181,10 @@ class Payload(ABC):
+ @property
+ def _binary_headers(self) -> bytes:
+ return (
+- "".join([k + ": " + v + "\r\n" for k, v in self.headers.items()]).encode(
+- "utf-8"
+- )
++ "".join(
++ _safe_header(k) + ": " + _safe_header(v) + "\r\n"
++ for k, v in self.headers.items()
++ ).encode("utf-8")
+ + b"\r\n"
+ )
+
+diff --git a/tests/test_http_writer.py b/tests/test_http_writer.py
+index 5649f32f7..62d112cad 100644
+--- a/tests/test_http_writer.py
++++ b/tests/test_http_writer.py
+@@ -6,6 +6,7 @@ import pytest
+ from multidict import CIMultiDict
+
+ from aiohttp import http
++from aiohttp.http_writer import _safe_header
+ from aiohttp.test_utils import make_mocked_coro
+
+
+@@ -264,6 +265,24 @@ async def test_drain_no_transport(protocol, transport, loop) -> None:
+ assert not protocol._drain_helper.called
+
+
++@pytest.mark.parametrize(
++ "char",
++ [chr(c) for c in (*range(0x00, 0x09), *range(0x0A, 0x20), 0x7F)],
++)
++def test_safe_header_rejects_forbidden_control_chars(char: str) -> None:
++ with pytest.raises(
++ ValueError,
++ match="Forbidden control character detected in headers",
++ ):
++ _safe_header(f"value{char}")
++
++
++def test_safe_header_allows_htab() -> None:
++ value = "text/plain\tcharset=utf-8"
++
++ assert _safe_header(value) == value
++
++
+ async def test_write_headers_prevents_injection(protocol, transport, loop) -> None:
+ msg = http.StreamWriter(protocol, loop)
+ status_line = "HTTP/1.1 200 OK"
+diff --git a/tests/test_payload.py b/tests/test_payload.py
+index c8681cb5e..52ace65fd 100644
+--- a/tests/test_payload.py
++++ b/tests/test_payload.py
+@@ -54,6 +54,21 @@ def test_payload_content_type() -> None:
+ assert p.content_type == "application/json"
+
+
++@pytest.mark.parametrize("bad_byte", ("\r", "\n", "\x00"))
++def test_binary_headers_reject_injection_in_value(bad_byte: str) -> None:
++ p = Payload("test", headers={"X-Custom": f"value{bad_byte}Injected: bad"})
++ with pytest.raises(ValueError, match="header injection"):
++ p._binary_headers
++
++
++@pytest.mark.parametrize("bad_byte", ("\r", "\n", "\x00"))
++def test_binary_headers_reject_injection_in_name(bad_byte: str) -> None:
++ p = Payload("test")
++ p.headers[f"X-Custom{bad_byte}Injected"] = "value"
++ with pytest.raises(ValueError, match="header injection"):
++ p._binary_headers
++
++
+ def test_bytes_payload_default_content_type() -> None:
+ p = payload.BytesPayload(b"data")
+ assert p.content_type == "application/octet-stream"
+--
+2.35.6
+
@@ -28,6 +28,7 @@ SRC_URI += "file://CVE-2024-52304.patch \
file://CVE-2026-34525_p1.patch \
file://CVE-2026-34525_p2.patch \
file://CVE-2026-47265.patch \
+ file://CVE-2026-50269.patch \
"
CVE_STATUS[CVE-2026-34515] = "not-applicable-platform: Vulnerability only affects applications running on Windows"