diff --git a/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-34514.patch b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-34514.patch
new file mode 100644
index 0000000000..baba4c9b91
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-34514.patch
@@ -0,0 +1,65 @@
+From b3aca47a956826116930a59e482953cacf78830a Mon Sep 17 00:00:00 2001
+From: Sam Bull <git@sambull.org>
+Date: Sat, 21 Feb 2026 00:17:11 +0000
+Subject: [PATCH] Fix multipart injection (#12104) (#12110)
+
+CVE: CVE-2026-34514
+Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06]
+
+(cherry picked from commit dab9e879be5606682a39b9dd378900eba0afd1a4)
+
+Co-authored-by: mingi jung <mingijung.grape@gmail.com>
+(cherry picked from commit 9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ aiohttp/formdata.py    |  5 +++++
+ tests/test_formdata.py | 16 +++++++++++-----
+ 2 files changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/aiohttp/formdata.py b/aiohttp/formdata.py
+index 2b75b3de7..c14ada176 100644
+--- a/aiohttp/formdata.py
++++ b/aiohttp/formdata.py
+@@ -79,6 +79,11 @@ class FormData:
+                 raise TypeError(
+                     "content_type must be an instance of str. " "Got: %s" % content_type
+                 )
++            if "\r" in content_type or "\n" in content_type:
++                raise ValueError(
++                    "Newline or carriage return detected in headers. "
++                    "Potential header injection attack."
++                )
+             headers[hdrs.CONTENT_TYPE] = content_type
+             self._is_multipart = True
+         if content_transfer_encoding is not None:
+diff --git a/tests/test_formdata.py b/tests/test_formdata.py
+index 4bb8aa075..9e331515c 100644
+--- a/tests/test_formdata.py
++++ b/tests/test_formdata.py
+@@ -46,12 +46,18 @@ def test_invalid_formdata_params2() -> None:
+         FormData("as")  # 2-char str is not allowed
+ 
+ 
+-def test_invalid_formdata_content_type() -> None:
++@pytest.mark.parametrize("val", (0, 0.1, {}, [], b"foo"))
++def test_invalid_type_formdata_content_type(val: object) -> None:
+     form = FormData()
+-    invalid_vals = [0, 0.1, {}, [], b"foo"]
+-    for invalid_val in invalid_vals:
+-        with pytest.raises(TypeError):
+-            form.add_field("foo", "bar", content_type=invalid_val)
++    with pytest.raises(TypeError):
++        form.add_field("foo", "bar", content_type=val)  # type: ignore[arg-type]
++
++
++@pytest.mark.parametrize("val", ("\r", "\n", "a\ra\n", "a\na\r"))
++def test_invalid_value_formdata_content_type(val: str) -> None:
++    form = FormData()
++    with pytest.raises(ValueError):
++        form.add_field("foo", "bar", content_type=val)
+ 
+ 
+ def test_invalid_formdata_filename() -> None:
+-- 
+2.44.4
+
diff --git a/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb b/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb
index fcc506e16f..acf2a873f4 100644
--- a/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb
+++ b/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb
@@ -17,6 +17,7 @@ SRC_URI += "file://CVE-2024-52304.patch \
            file://CVE-2025-69227.patch \
            file://CVE-2025-69223.patch \
            file://CVE-2026-22815.patch \
+           file://CVE-2026-34514.patch \
            "
 
 CVE_STATUS[CVE-2026-34515] = "not-applicable-platform: Vulnerability only affects applications running on Windows"