Описание
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues:
- CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate (bsc#1273125).
- CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
Список пакетов
SUSE Linux Enterprise Module for Public Cloud 15 SP4
SUSE Linux Enterprise Module for Public Cloud 15 SP5
SUSE Linux Enterprise Module for Public Cloud 15 SP6
SUSE Linux Enterprise Module for Public Cloud 15 SP7
Ссылки
- Link for SUSE-SU-2026:4113-1
- E-Mail link for SUSE-SU-2026:4113-1
- SUSE Security Ratings
- SUSE Bug 1273125
- SUSE Bug 1273553
- SUSE CVE CVE-2026-59881 page
- SUSE CVE CVE-2026-69243 page
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
Затронутые продукты
Ссылки
- CVE-2026-59881
- SUSE Bug 1273125
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
Затронутые продукты
Ссылки
- CVE-2026-69243
- SUSE Bug 1273553