Описание
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues:
- CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate (bsc#1273125).
- CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
- CVE-2026-69244: out-of-bounds heap read in the C response parser while building an error message for a malformed response (bsc#1273552).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1273125
- SUSE Bug 1273552
- SUSE Bug 1273553
- SUSE CVE CVE-2026-59881 page
- SUSE CVE CVE-2026-69243 page
- SUSE CVE CVE-2026-69244 page
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
Затронутые продукты
Ссылки
- CVE-2026-59881
- SUSE Bug 1273125
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
Затронутые продукты
Ссылки
- CVE-2026-69243
- SUSE Bug 1273553
Описание
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
Затронутые продукты
Ссылки
- CVE-2026-69244
- SUSE Bug 1273552