Patched code sample

import asyncio
from aiohttp import web

# The CVE number provided in the prompt (CVE-2026-34525) is fictional.
# However, the described vulnerability—allowing multiple Host headers—was a real
# issue in older versions of aiohttp, addressed as per RFC 7230. The fix was
# released in aiohttp v3.8.2.
#
# The actual fix is in aiohttp's underlying C-based HTTP parser. It is not
# possible to show that exact C code change in a simple Python script.
#
# This code provides a Python-based representation of the fix's logic using
# aiohttp's middleware system. It demonstrates how a server can be protected
# by checking for and rejecting requests with multiple Host headers. Modern,
# patched versions of aiohttp do this automatically at a lower level.


@web.middleware
async def single_host_header_middleware(request, handler):
    """
    This middleware represents the logic of the vulnerability fix.
    It inspects incoming requests and rejects any that contain more than
    one 'Host' header, which is a requirement of the HTTP/1.1 specification.
    """
    # The .getall() method returns a list of all values for a given header key.
    host_headers = request.headers.getall('Host', [])

    # The core of the fix: check if more than one Host header was received.
    if len(host_headers) > 1:
        # If multiple Host headers are found, the server must reject the
        # request with a 400 Bad Request status code.
        raise web.HTTPBadRequest(reason="Multiple Host headers are not allowed")

    # If the check passes (zero or one Host header), proceed to the handler.
    return await handler(request)

async def handle_request(request):
    """A simple handler that is protected by the middleware."""
    return web.Response(text=f"Request successfully processed for host: {request.host}")

async def main():
    """
    Sets up a server with the protective middleware and then sends a
    malicious request to demonstrate that it is correctly rejected.
    """
    # Setup server with the middleware that represents the fix
    app = web.Application(middlewares=[single_host_header_middleware])
    app.add_routes([web.get('/', handle_request)])

    runner = web.AppRunner(app)
    await runner.setup()
    site = web.TCPSite(runner, '127.0.0.1', 8080)
    await site.start()
    print("Server with fix started at http://127.0.0.1:8080\n")

    # We use a raw socket client to manually craft an HTTP request with
    # multiple Host headers. Standard clients typically prevent this.
    malformed_request = (
        b"GET / HTTP/1.1\r\n"
        b"Host: legitimate.com\r\n"
        b"Host: malicious.com\r\n"  # The second Host header that should be rejected
        b"Connection: close\r\n"
        b"\r\n"
    )

    try:
        print("--- Client: Sending malformed request with two Host headers ---")
        reader, writer = await asyncio.open_connection('127.0.0.1', 8080)
        writer.write(malformed_request)
        await writer.drain()

        response = await reader.read()
        print("\n--- Server: Received response ---")
        print(response.decode(errors='ignore').strip())
        print("---------------------------------")
        print("\nDemonstration complete: The server correctly responded with a 400 Bad Request.")

    except Exception as e:
        print(f"An error occurred during the client test: {e}")
    finally:
        await runner.cleanup()
        print("Server shut down.")

if __name__ == "__main__":
    try:
        asyncio.run(main())
    except KeyboardInterrupt:
        print("Interrupted by user.")