Описание
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues
- CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service (bsc#1261320).
- CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321).
- CVE-2026-34514:
content_typeparameter manipulation can lead to header injection (bsc#1261322). - CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of service (bsc#1261329).
- CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service (bsc#1261331).
- CVE-2026-34518: retained
CookieandProxy-Authorizationheaders when following redirects can lead to information disclosure (bsc#1261332). - CVE-2026-34519: response
reasonparameter can be use to perform header injection (bsc#1261334). - CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).
- CVE-2026-34525: multiple
Hostheaders allow for potential security bypass in proxy servers (bsc#1261343). - CVE-2026-34993: loading untrusted input in
CookieJar.load()can lead to arbitrary code execution (bsc#1267471). - CVE-2026-47265: cookies set with the
cookiesparameter on requests are sent after following a cross-origin redirect and can leak sensitive data (bsc#1267561). - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398).
- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543).
- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544).
- CVE-2026-54275:
server_hostnameTLS SNI check bypass when an existing connection is reused (bsc#1268549). - CVE-2026-54277:
max_line_sizebypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556). - CVE-2026-54278: unread compressed request bodies can bypass
client_max_sizeduring cleanup and cause a DoS (bsc#1268559). - CVE-2026-54279: host-only cookies become domain cookies after
CookieJarpersistence (bsc#1268560). - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Module for Public Cloud 15 SP4
SUSE Linux Enterprise Module for Python 3 15 SP7
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:3207-1
- E-Mail link for SUSE-SU-2026:3207-1
- SUSE Security Ratings
- SUSE Bug 1261320
- SUSE Bug 1261321
- SUSE Bug 1261322
- SUSE Bug 1261329
- SUSE Bug 1261331
- SUSE Bug 1261332
- SUSE Bug 1261334
- SUSE Bug 1261335
- SUSE Bug 1261343
- SUSE Bug 1267471
- SUSE Bug 1267561
- SUSE Bug 1268398
- SUSE Bug 1268543
- SUSE Bug 1268544
- SUSE Bug 1268549
- SUSE Bug 1268556
- SUSE Bug 1268559
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-22815
- SUSE Bug 1261320
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34513
- SUSE Bug 1261321
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34514
- SUSE Bug 1261322
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34516
- SUSE Bug 1261329
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34517
- SUSE Bug 1261331
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34518
- SUSE Bug 1261332
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34519
- SUSE Bug 1261334
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34520
- SUSE Bug 1261335
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34525
- SUSE Bug 1261343
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.
Затронутые продукты
Ссылки
- CVE-2026-34993
- SUSE Bug 1267471
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
Затронутые продукты
Ссылки
- CVE-2026-47265
- SUSE Bug 1267561
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.
Затронутые продукты
Ссылки
- CVE-2026-50269
- SUSE Bug 1268398
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54273
- SUSE Bug 1268543
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54274
- SUSE Bug 1268544
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54275
- SUSE Bug 1268549
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54277
- SUSE Bug 1268556
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54278
- SUSE Bug 1268559
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54279
- SUSE Bug 1268560
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54280
- SUSE Bug 1268561