Поиск уязвимостей
Количество 10
Количество 10
BDU:2026-11139
Уязвимость парсера HTTP-запросов HTTP-клиента aiohttp, позволяющая нарушителю обойти существующие механизмы безопасности
CVE-2026-69243
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
CVE-2026-69243
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
CVE-2026-69243
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
CVE-2026-69243
AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...
GHSA-mfx4-hv73-q22v
AIOHTTP: HTTP request smuggling via WebSocket upgrade
SUSE-SU-2026:4113-1
Security update for python-aiohttp
openSUSE-SU-2026:21687-1
Security update for python-aiohttp
SUSE-SU-2026:4031-1
Security update for python-aiohttp
ELSA-2026-604898
ELSA-2026-604898: python-oci-sdk security update (IMPORTANT)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2026-11139 Уязвимость парсера HTTP-запросов HTTP-клиента aiohttp, позволяющая нарушителю обойти существующие механизмы безопасности | CVSS3: 5.3 | 0% Низкий | 4 месяца назад |
 | CVE-2026-69243 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2. | 0% Низкий | 3 месяца назад | |
 | CVE-2026-69243 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2. | CVSS3: 7 | 0% Низкий | 3 месяца назад |
 | CVE-2026-69243 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2. | 0% Низкий | 3 месяца назад | |
| CVE-2026-69243 AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... | 0% Низкий | 3 месяца назад | |
| GHSA-mfx4-hv73-q22v AIOHTTP: HTTP request smuggling via WebSocket upgrade | 0% Низкий | 3 месяца назад | |
 | SUSE-SU-2026:4113-1 Security update for python-aiohttp | 2 месяца назад | ||
| openSUSE-SU-2026:21687-1 Security update for python-aiohttp | 2 месяца назад | ||
| SUSE-SU-2026:4031-1 Security update for python-aiohttp | 2 месяца назад | ||
| ELSA-2026-604898 ELSA-2026-604898: python-oci-sdk security update (IMPORTANT) | 20 дней назад |
Уязвимостей на страницу