AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass (CVE-2026-34520) | HOL Guard CVE