Описание
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues
- CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
- CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
- CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
- CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
- CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
- CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).
- CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
- CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
- CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
- CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
- CVE-2026-47265: cookies set with the
cookiesparameter on requests are sent after following a cross-origin redirect (bsc#1267561).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1261320
- SUSE Bug 1261321
- SUSE Bug 1261322
- SUSE Bug 1261329
- SUSE Bug 1261331
- SUSE Bug 1261332
- SUSE Bug 1261334
- SUSE Bug 1261335
- SUSE Bug 1261343
- SUSE Bug 1267471
- SUSE Bug 1267561
- SUSE CVE CVE-2026-22815 page
- SUSE CVE CVE-2026-34513 page
- SUSE CVE CVE-2026-34514 page
- SUSE CVE CVE-2026-34516 page
- SUSE CVE CVE-2026-34517 page
- SUSE CVE CVE-2026-34518 page
- SUSE CVE CVE-2026-34519 page
- SUSE CVE CVE-2026-34520 page
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-22815
- SUSE Bug 1261320
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34513
- SUSE Bug 1261321
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34514
- SUSE Bug 1261322
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34516
- SUSE Bug 1261329
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34517
- SUSE Bug 1261331
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34518
- SUSE Bug 1261332
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34519
- SUSE Bug 1261334
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34520
- SUSE Bug 1261335
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
Затронутые продукты
Ссылки
- CVE-2026-34525
- SUSE Bug 1261343
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.
Затронутые продукты
Ссылки
- CVE-2026-34993
- SUSE Bug 1267471
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
Затронутые продукты
Ссылки
- CVE-2026-47265
- SUSE Bug 1267561