Vulnerability-Lookup

SUSE-SU-2026:22819-1

Vulnerability from csaf_suse - Published: 2026-07-18 09:52 - Updated: 2026-09-16 20:06

Summary

Security update for python-aiohttp

Severity

Important

Notes

Title of the patch: Security update for python-aiohttp

Description of the patch: This update for python-aiohttp fixes the following issues - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398). - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543). - CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544). - CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549). - CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556). - CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS (bsc#1268559). - CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560). - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).

Patchnames: SUSE-SLES-16.0-1281

CVE-2026-50269

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-54273

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2026-50269

Threats

Impact important

CVE-2026-54274

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2026-50269

Threats

Impact important

CVE-2026-54275

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

Recommended 8 products, the same list as for CVE-2026-50269

Threats

Impact moderate

CVE-2026-54277

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2026-50269

Threats

Impact important

CVE-2026-54278

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2026-50269

Threats

Impact moderate

CVE-2026-54279

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2026-50269

Threats

Impact moderate

CVE-2026-54280

3.1 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 8 products, the same list as for CVE-2026-50269

Threats

Impact low

References

36 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1268398	self
https://bugzilla.suse.com/1268543	self
https://bugzilla.suse.com/1268544	self
https://bugzilla.suse.com/1268549	self
https://bugzilla.suse.com/1268556	self
https://bugzilla.suse.com/1268559	self
https://bugzilla.suse.com/1268560	self
https://bugzilla.suse.com/1268561	self
https://www.suse.com/security/cve/CVE-2026-50269/	self
https://www.suse.com/security/cve/CVE-2026-54273/	self
https://www.suse.com/security/cve/CVE-2026-54274/	self
https://www.suse.com/security/cve/CVE-2026-54275/	self
https://www.suse.com/security/cve/CVE-2026-54277/	self
https://www.suse.com/security/cve/CVE-2026-54278/	self
https://www.suse.com/security/cve/CVE-2026-54279/	self
https://www.suse.com/security/cve/CVE-2026-54280/	self
https://www.suse.com/security/cve/CVE-2026-50269	external
https://bugzilla.suse.com/1268398	external
https://www.suse.com/security/cve/CVE-2026-54273	external
https://bugzilla.suse.com/1268543	external
https://www.suse.com/security/cve/CVE-2026-54274	external
https://bugzilla.suse.com/1268544	external
https://www.suse.com/security/cve/CVE-2026-54275	external
https://bugzilla.suse.com/1268549	external
https://www.suse.com/security/cve/CVE-2026-54277	external
https://bugzilla.suse.com/1268556	external
https://www.suse.com/security/cve/CVE-2026-54278	external
https://bugzilla.suse.com/1268559	external
https://www.suse.com/security/cve/CVE-2026-54279	external
https://bugzilla.suse.com/1268560	external
https://www.suse.com/security/cve/CVE-2026-54280	external
https://bugzilla.suse.com/1268561	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-aiohttp",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-aiohttp fixes the following issues\n\n- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers\n  (bsc#1268398).\n- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption\n  (bsc#1268543).\n- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive\n  resource consumption (bsc#1268544).\n- CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549).\n- CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource\n  consumption (bsc#1268556).\n- CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS\n  (bsc#1268559).\n- CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).\n- CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and\n  can cause resource starvation (bsc#1268561).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-1281",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22819-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22819-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622819-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22819-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027922.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268398",
        "url": "https://bugzilla.suse.com/1268398"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268543",
        "url": "https://bugzilla.suse.com/1268543"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268544",
        "url": "https://bugzilla.suse.com/1268544"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268549",
        "url": "https://bugzilla.suse.com/1268549"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268556",
        "url": "https://bugzilla.suse.com/1268556"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268559",
        "url": "https://bugzilla.suse.com/1268559"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268560",
        "url": "https://bugzilla.suse.com/1268560"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268561",
        "url": "https://bugzilla.suse.com/1268561"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50269 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50269/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54273 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54273/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54274 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54274/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54275 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54275/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54277 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54277/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54278 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54278/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54279 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54279/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54280 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54280/"
      }
    ],
    "title": "Security update for python-aiohttp",
    "tracking": {
      "current_release_date": "2026-09-16T20:06:29Z",
      "generator": {
        "date": "2026-07-18T09:52:53Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22819-1",
      "initial_release_date": "2026-07-18T09:52:53Z",
      "revision_history": [
        {
          "date": "2026-07-18T09:52:53Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T19:18:01Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T20:06:29Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.6.1.aarch64",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.6.1.aarch64",
                  "product_id": "python313-aiohttp-3.11.16-160000.6.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:aiohttp_project:aiohttp:3.11.16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-aiohttp@3.11.16-160000.6.1?arch=aarch64\u0026upstream=python-aiohttp-3.11.16-160000.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.6.1.ppc64le",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.6.1.ppc64le",
                  "product_id": "python313-aiohttp-3.11.16-160000.6.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:aiohttp_project:aiohttp:3.11.16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-aiohttp@3.11.16-160000.6.1?arch=ppc64le\u0026upstream=python-aiohttp-3.11.16-160000.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.6.1.s390x",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.6.1.s390x",
                  "product_id": "python313-aiohttp-3.11.16-160000.6.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:aiohttp_project:aiohttp:3.11.16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-aiohttp@3.11.16-160000.6.1?arch=s390x\u0026upstream=python-aiohttp-3.11.16-160000.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.6.1.x86_64",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.6.1.x86_64",
                  "product_id": "python313-aiohttp-3.11.16-160000.6.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:aiohttp_project:aiohttp:3.11.16:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-aiohttp@3.11.16-160000.6.1?arch=x86_64\u0026upstream=python-aiohttp-3.11.16-160000.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.6.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.6.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.6.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.6.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.6.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.6.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.6.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.6.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.6.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.6.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.6.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.6.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.6.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.6.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-50269",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50269"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50269",
          "url": "https://www.suse.com/security/cve/CVE-2026-50269"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268398 for CVE-2026-50269",
          "url": "https://bugzilla.suse.com/1268398"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-18T09:52:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-50269"
    },
    {
      "cve": "CVE-2026-54273",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54273"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54273",
          "url": "https://www.suse.com/security/cve/CVE-2026-54273"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268543 for CVE-2026-54273",
          "url": "https://bugzilla.suse.com/1268543"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-18T09:52:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-54273"
    },
    {
      "cve": "CVE-2026-54274",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54274"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54274",
          "url": "https://www.suse.com/security/cve/CVE-2026-54274"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268544 for CVE-2026-54274",
          "url": "https://bugzilla.suse.com/1268544"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-18T09:52:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-54274"
    },
    {
      "cve": "CVE-2026-54275",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54275"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54275",
          "url": "https://www.suse.com/security/cve/CVE-2026-54275"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268549 for CVE-2026-54275",
          "url": "https://bugzilla.suse.com/1268549"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-18T09:52:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-54275"
    },
    {
      "cve": "CVE-2026-54277",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54277"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54277",
          "url": "https://www.suse.com/security/cve/CVE-2026-54277"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268556 for CVE-2026-54277",
          "url": "https://bugzilla.suse.com/1268556"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-18T09:52:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-54277"
    },
    {
      "cve": "CVE-2026-54278",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54278"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54278",
          "url": "https://www.suse.com/security/cve/CVE-2026-54278"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268559 for CVE-2026-54278",
          "url": "https://bugzilla.suse.com/1268559"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-18T09:52:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-54278"
    },
    {
      "cve": "CVE-2026-54279",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54279"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54279",
          "url": "https://www.suse.com/security/cve/CVE-2026-54279"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268560 for CVE-2026-54279",
          "url": "https://bugzilla.suse.com/1268560"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-18T09:52:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-54279"
    },
    {
      "cve": "CVE-2026-54280",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54280"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54280",
          "url": "https://www.suse.com/security/cve/CVE-2026-54280"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268561 for CVE-2026-54280",
          "url": "https://bugzilla.suse.com/1268561"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-18T09:52:53Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-54280"
    }
  ]
}

CVE-2026-50269 (GCVE-0-2026-50269)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:30 – Updated: 2026-06-22 17:22

Title

AIOHTTP: CRLF injection in multipart headers

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

Severity

2.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 17:22 UTC

CWE

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/bf8807…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aio-libs	aiohttp	Affected: < 3.14.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50269",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:22:25.141712Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:22:34.049Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T16:30:55.789Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8"
        }
      ],
      "source": {
        "advisory": "GHSA-m6qw-4cw2-hm4m",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP: CRLF injection in multipart headers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50269",
    "datePublished": "2026-06-22T16:30:55.789Z",
    "dateReserved": "2026-06-04T16:26:05.984Z",
    "dateUpdated": "2026-06-22T17:22:34.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54273 (GCVE-0-2026-54273)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:41 – Updated: 2026-06-22 17:38

Title

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

Severity

6.6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 17:37 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/dfdfa9…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aio-libs	aiohttp	Affected: < 3.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54273",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:37:59.063772Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:38:06.286Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T16:41:20.261Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf"
        }
      ],
      "source": {
        "advisory": "GHSA-4fvr-rgm6-gqmc",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54273",
    "datePublished": "2026-06-22T16:41:20.261Z",
    "dateReserved": "2026-06-12T17:13:32.280Z",
    "dateUpdated": "2026-06-22T17:38:06.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54274 (GCVE-0-2026-54274)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:33 – Updated: 2026-06-22 18:14

Title

AIOHTTP: Incomplete websocket frame payloads bypass memory limits

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

Severity

6.6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 18:11 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/14b6ee…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aio-libs	aiohttp	Affected: < 3.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54274",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T18:11:47.837374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T18:14:44.845Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T16:33:37.789Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d"
        }
      ],
      "source": {
        "advisory": "GHSA-xcgm-r5h9-7989",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP: Incomplete websocket frame payloads bypass memory limits"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54274",
    "datePublished": "2026-06-22T16:33:37.789Z",
    "dateReserved": "2026-06-12T17:13:32.280Z",
    "dateUpdated": "2026-06-22T18:14:44.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54275 (GCVE-0-2026-54275)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:34 – Updated: 2026-06-22 17:27

Title

AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.

Severity

2.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 17:27 UTC

CWE

CWE-297 - Improper Validation of Certificate with Host Mismatch

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
aio-libs	aiohttp	Affected: < 3.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54275",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:27:21.140999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:27:34.536Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "CWE-297: Improper Validation of Certificate with Host Mismatch",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T16:34:56.184Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5"
        }
      ],
      "source": {
        "advisory": "GHSA-4m7w-qmgq-4wj5",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54275",
    "datePublished": "2026-06-22T16:34:56.184Z",
    "dateReserved": "2026-06-12T17:13:32.280Z",
    "dateUpdated": "2026-06-22T17:27:34.536Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54277 (GCVE-0-2026-54277)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:37 – Updated: 2026-06-23 16:10

Title

AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

Severity

6.6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 14:48 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/5ab61b…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aio-libs	aiohttp	Affected: < 3.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54277",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T14:48:04.651381Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T16:10:22.363Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T16:37:28.532Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d"
        }
      ],
      "source": {
        "advisory": "GHSA-63hw-fmq6-xxg2",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54277",
    "datePublished": "2026-06-22T16:37:28.532Z",
    "dateReserved": "2026-06-12T17:13:32.280Z",
    "dateUpdated": "2026-06-23T16:10:22.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54278 (GCVE-0-2026-54278)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:38 – Updated: 2026-06-23 16:10

Title

AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.

Severity

6.6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 13:51 UTC

CWE

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/4f7480…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aio-libs	aiohttp	Affected: < 3.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54278",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T13:51:45.481256Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T16:10:36.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T16:38:38.838Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232"
        }
      ],
      "source": {
        "advisory": "GHSA-g3cq-j2xw-wf74",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54278",
    "datePublished": "2026-06-22T16:38:38.838Z",
    "dateReserved": "2026-06-12T17:13:32.280Z",
    "dateUpdated": "2026-06-23T16:10:36.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54279 (GCVE-0-2026-54279)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:32 – Updated: 2026-06-22 17:40

Title

AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

Severity

1.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 17:40 UTC

CWE

CWE-665 - Improper Initialization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/a329a7…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aio-libs	aiohttp	Affected: < 3.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54279",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:40:17.638561Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:40:23.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 1.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-665",
              "description": "CWE-665: Improper Initialization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T16:32:45.407Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2"
        }
      ],
      "source": {
        "advisory": "GHSA-2fqr-mr3j-6wp8",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54279",
    "datePublished": "2026-06-22T16:32:45.407Z",
    "dateReserved": "2026-06-12T17:13:32.280Z",
    "dateUpdated": "2026-06-22T17:40:23.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54280 (GCVE-0-2026-54280)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:40 – Updated: 2026-06-22 18:18

Title

AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

Summary

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

Severity

1.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 18:15 UTC

CWE

CWE-404 - Improper Resource Shutdown or Release

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/aio-libs/aiohttp/security/advi…	x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/a762ed…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aio-libs	aiohttp	Affected: < 3.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54280",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T18:15:32.209522Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T18:18:21.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 1.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "CWE-404: Improper Resource Shutdown or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T16:40:23.157Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587"
        }
      ],
      "source": {
        "advisory": "GHSA-9x8q-7h8h-wcw9",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54280",
    "datePublished": "2026-06-22T16:40:23.157Z",
    "dateReserved": "2026-06-12T17:13:32.280Z",
    "dateUpdated": "2026-06-22T18:18:21.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:22819-1

CVE-2026-50269 (GCVE-0-2026-50269)

CVE-2026-54273 (GCVE-0-2026-54273)

CVE-2026-54274 (GCVE-0-2026-54274)

CVE-2026-54275 (GCVE-0-2026-54275)

CVE-2026-54277 (GCVE-0-2026-54277)

CVE-2026-54278 (GCVE-0-2026-54278)

CVE-2026-54279 (GCVE-0-2026-54279)

CVE-2026-54280 (GCVE-0-2026-54280)

Tags

Sightings

Nomenclature

Related by attack behaviour