Описание
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues
- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398).
- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543).
- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544).
- CVE-2026-54275:
server_hostnameTLS SNI check bypass when an existing connection is reused (bsc#1268549). - CVE-2026-54277:
max_line_sizebypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556). - CVE-2026-54278: unread compressed request bodies can bypass
client_max_sizeduring cleanup and cause a DoS (bsc#1268559). - CVE-2026-54279: host-only cookies become domain cookies after
CookieJarpersistence (bsc#1268560). - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1268398
- SUSE Bug 1268543
- SUSE Bug 1268544
- SUSE Bug 1268549
- SUSE Bug 1268556
- SUSE Bug 1268559
- SUSE Bug 1268560
- SUSE Bug 1268561
- SUSE CVE CVE-2026-50269 page
- SUSE CVE CVE-2026-54273 page
- SUSE CVE CVE-2026-54274 page
- SUSE CVE CVE-2026-54275 page
- SUSE CVE CVE-2026-54277 page
- SUSE CVE CVE-2026-54278 page
- SUSE CVE CVE-2026-54279 page
- SUSE CVE CVE-2026-54280 page
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.
Затронутые продукты
Ссылки
- CVE-2026-50269
- SUSE Bug 1268398
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54273
- SUSE Bug 1268543
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54274
- SUSE Bug 1268544
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54275
- SUSE Bug 1268549
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54277
- SUSE Bug 1268556
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54278
- SUSE Bug 1268559
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54279
- SUSE Bug 1268560
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.
Затронутые продукты
Ссылки
- CVE-2026-54280
- SUSE Bug 1268561