Every CVE Search/ Get API key

CVE-2026-34993

AIOHTTP Vulnerable to Deserialization of Untrusted Data

6.4 MediumFix available

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
Low

Exploit likelihood

0.18%Up 0.1 points since Jun 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.4

AIOHTTP Vulnerable to Deserialization of Untrusted Data

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Record
CVE-2026-34993
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-502, CWE-502
Updated
2026-11-02
EUVDEUVD-2026-34001 7.2

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Record
EUVD-2026-34001
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-jg22-mg44-37j8 6.4

AIOHTTP is Vulnerable to Deserialization of Untrusted Data

Summary

Using CookieJar.load() with untrusted input may allow arbitrary code execution.

Impact

Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.

Workaround

If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading.

Patch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00

Record
GHSA-jg22-mg44-37j8
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-502
Updated
2026-11-02
NVD 6.4

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Record
CVE-2026-34993
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSV 6.4

AIOHTTP Vulnerable to Deserialization of Untrusted Data

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Record
CVE-2026-34993
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-502
Updated
2026-11-02
OSVDEBIAN-CVE-2026-34993 7.3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Record
DEBIAN-CVE-2026-34993
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 24 moreShow less
OSVGHSA-jg22-mg44-37j8 6.4

AIOHTTP is Vulnerable to Deserialization of Untrusted Data

Summary

Using CookieJar.load() with untrusted input may allow arbitrary code execution.

Impact

Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.

Workaround

If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading.

Patch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00

Record
GHSA-jg22-mg44-37j8
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-502
Updated
2026-11-02
OSVOESA-2026-2562 6.6

python-aiohttp security update

Async http client/server framework (asyncio).

Security Fix(es):

Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.(CVE-2026-34993)

If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.(CVE-2026-47265)

Record
OESA-2026-2562
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-2563 6.6

python-aiohttp security update

Async http client/server framework (asyncio).

Security Fix(es):

Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.(CVE-2026-34993)

If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.(CVE-2026-47265)

Record
OESA-2026-2563
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVPYSEC-2026-2104 7.3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Record
PYSEC-2026-2104
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:50319 8.2

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:50319
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:50336 8.2

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:50336
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:59135 8.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:59135
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:59136 8.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:59136
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63327 8.1

Red Hat Security Advisory: Satellite 6.16.13 Async Update

Record
RHSA-2026:63327
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63385 8.8

Red Hat Security Advisory: Satellite 6.19.4 Async Update

Record
RHSA-2026:63385
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63386 8.1

Red Hat Security Advisory: Satellite 6.18.9 Async Update

Record
RHSA-2026:63386
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63387 8.1

Red Hat Security Advisory: Satellite 6.17.11 Async Update

Record
RHSA-2026:63387
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34993 6.4

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Record
UBUNTU-CVE-2026-34993
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-89330 No score

CVE-2026-34993 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load() with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Record
AZL-89330
Updated
2026-11-05
OSVCLSA-2026-1789467837 No score

TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.6.post13+tuxcare.

Record
CLSA-2026-1789467837
Updated
2026-11-02
OSVCLSA-2026-1789542238 No score

TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post14+tuxcare.

Record
CLSA-2026-1789542238
Updated
2026-11-02
OSVCLSA-2026-1789638581 No score

TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.4.post10+tuxcare.

Record
CLSA-2026-1789638581
Updated
2026-11-02
OSVCLSA-2026-1791377424 No score

TuxCare security update for aiohttp (7 CVEs)

TuxCare rebuilt aiohttp to address 7 CVEs. Fixed in 3.8.1.post16+tuxcare.

Record
CLSA-2026-1791377424
Updated
2026-11-02
OSVopenSUSE-SU-2026:10963-1 No score

python311-aiohttp-3.14.0-1.1 on GA media

These are all security issues fixed in the python311-aiohttp-3.14.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10963-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21098-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues

  • CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
  • CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
  • CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
  • CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
  • CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
  • CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).
  • CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
  • CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
  • CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
  • CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
  • CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect (bsc#1267561).
Record
openSUSE-SU-2026:21098-1
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-34993 No score

CVE-2026-34993 in aiohttp - Patched by Root

Root has patched CVE-2026-34993 in the aiohttp package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-34993
Updated
2026-11-02
OSVSUSE-SU-2026:22173-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues

  • CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
  • CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
  • CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
  • CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
  • CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
  • CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).
  • CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
  • CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
  • CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
  • CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
  • CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect (bsc#1267561).
Record
SUSE-SU-2026:22173-1
Updated
2026-11-02
OSVSUSE-SU-2026:3059-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues

  • CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
  • CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
  • CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
  • CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
  • CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
  • CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).
  • CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
  • CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
  • CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
  • CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
  • CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect (bsc#1267561).
Record
SUSE-SU-2026:3059-1
Updated
2026-11-02
OSVSUSE-SU-2026:3207-1 No score

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues

  • CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service (bsc#1261320).
  • CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321).
  • CVE-2026-34514: content_type parameter manipulation can lead to header injection (bsc#1261322).
  • CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of service (bsc#1261329).
  • CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service (bsc#1261331).
  • CVE-2026-34518: retained Cookie and Proxy-Authorization headers when following redirects can lead to information disclosure (bsc#1261332).
  • CVE-2026-34519: response reason parameter can be use to perform header injection (bsc#1261334).
  • CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).
  • CVE-2026-34525: multiple Host headers allow for potential security bypass in proxy servers (bsc#1261343).
  • CVE-2026-34993: loading untrusted input in CookieJar.load() can lead to arbitrary code execution (bsc#1267471).
  • CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect and can leak sensitive data (bsc#1267561).
  • CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398).
  • CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543).
  • CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544).
  • CVE-2026-54275: server_hostname TLS SNI check bypass when an existing connection is reused (bsc#1268549).
  • CVE-2026-54277: max_line_size bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556).
  • CVE-2026-54278: unread compressed request bodies can bypass client_max_size during cleanup and cause a DoS (bsc#1268559).
  • CVE-2026-54279: host-only cookies become domain cookies after CookieJar persistence (bsc#1268560).
  • CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).
Record
SUSE-SU-2026:3207-1
Updated
2026-11-02

Affected products

Show 19 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
aiohttp
PyPI
 before 3.14.0
3.14.0
python-aiohttp
Azure Linux:3
 through 3.6.2-3 None known
aiohttp
TuxCare:PyPI
From an advisory covering 2 CVEs
 3.8.6 up to 3.8.6.post13+tuxcare, plus listed versions
3.8.6.post1+tuxcare3.8.6.post10+tuxcare3.8.6.post11+tuxcare3.8.6.post12+tuxcare3.8.6.post2+tuxcare
Show 7 moreShow less
3.8.6.post3+tuxcare3.8.6.post4+tuxcare3.8.6.post5+tuxcare3.8.6.post6+tuxcare3.8.6.post7+tuxcare3.8.6.post8+tuxcare3.8.6.post9+tuxcare
3.8.6.post13+tuxcare
aiohttp
TuxCare:PyPI
 3.8.5 up to 3.8.5.post14+tuxcare, plus listed versions
3.8.5.post1+tuxcare3.8.5.post10+tuxcare3.8.5.post11+tuxcare3.8.5.post12+tuxcare3.8.5.post13+tuxcare
Show 8 moreShow less
3.8.5.post2+tuxcare3.8.5.post3+tuxcare3.8.5.post4+tuxcare3.8.5.post5+tuxcare3.8.5.post6+tuxcare3.8.5.post7+tuxcare3.8.5.post8+tuxcare3.8.5.post9+tuxcare
3.8.5.post14+tuxcare
aiohttp
TuxCare:PyPI
 3.8.4 up to 3.8.4.post10+tuxcare, plus listed versions
3.8.4.post1+tuxcare3.8.4.post2+tuxcare3.8.4.post3+tuxcare3.8.4.post4+tuxcare3.8.4.post5+tuxcare
Show 4 moreShow less
3.8.4.post6+tuxcare3.8.4.post7+tuxcare3.8.4.post8+tuxcare3.8.4.post9+tuxcare
3.8.4.post10+tuxcare
aiohttp
TuxCare:PyPI
From an advisory covering 7 CVEs
 3.8.1 up to 3.8.1.post16+tuxcare, plus listed versions
3.8.1.post1+tuxcare3.8.1.post10+tuxcare3.8.1.post11+tuxcare3.8.1.post12+tuxcare3.8.1.post13+tuxcare
Show 10 moreShow less
3.8.1.post14+tuxcare3.8.1.post15+tuxcare3.8.1.post2+tuxcare3.8.1.post3+tuxcare3.8.1.post4+tuxcare3.8.1.post5+tuxcare3.8.1.post6+tuxcare3.8.1.post7+tuxcare3.8.1.post8+tuxcare3.8.1.post9+tuxcare
3.8.1.post16+tuxcare
python-aiohttp
Debian:12
 before 3.8.4-1+deb12u2, plus listed versions
3.8.4-13.8.4-1+deb12u1
3.8.4-1+deb12u2
python-aiohttp
Debian:13
 All versions, plus listed versions
3.11.16-13.11.16-1+deb13u13.12.15-13.13.0-13.13.1-1
Show 11 moreShow less
3.13.3-13.13.3-23.13.3-33.13.5-13.14.0-13.14.1-13.14.1-23.14.1-33.14.1-43.14.1-53.14.3-1
 None known
python-aiohttp
Debian:14
 before 3.14.0-1, plus listed versions
3.11.16-13.12.15-13.13.0-13.13.1-13.13.3-13.13.3-23.13.3-33.13.5-1
3.14.0-1
aiohttp
PyPI
 before 3.14.0, plus listed versions
0.10.10.00.10.10.10.20.11.0
Show 45 moreShow less
0.12.00.13.00.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.15.30.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.10.18.20.18.30.18.40.19.00.20.20.00.20.10.20.20.21.00.21.10.21.20.21.40.21.50.21.60.22.00.22.0a00.22.0b00.22.0b10.22.0b2
3.14.0
Show 223 moreShow less
Affected packages
PackageAffectedFixed
python-aiohttp
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 3.14.0-1.oe2403sp1
3.14.0-1.oe2403sp1
python-aiohttp
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 3.14.0-1.oe2403sp3
3.14.0-1.oe2403sp3
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.1.21-1.el8ap
0:1.1.21-1.el8ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.1.21-1.el8ap
0:1.1.21-1.el8ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.1.21-1.el8ap
0:1.1.21-1.el8ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.1.21-1.el8ap
0:1.1.21-1.el8ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.1.21-1.el8ap
0:1.1.21-1.el8ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.1.21-1.el9ap
0:1.1.21-1.el9ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.1.21-1.el9ap
0:1.1.21-1.el9ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.1.21-1.el9ap
0:1.1.21-1.el9ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.1.21-1.el9ap
0:1.1.21-1.el9ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.1.21-1.el9ap
0:1.1.21-1.el9ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el8ap
0:1.6.7-1.el8ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el8ap
0:1.6.7-1.el8ap
receptor
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el8ap
0:1.6.7-1.el8ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:2.5.10-7.el8ap
0:2.5.10-7.el8ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:2.6.17-2.el9ap
0:2.6.17-2.el9ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:3.14.1-2.el8ap
0:3.14.1-2.el8ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:3.14.1-2.el9ap
0:3.14.1-2.el9ap
automation-gateway-proxy
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:2.5.10-7.el8ap
0:2.5.10-7.el8ap
automation-gateway-proxy-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:2.5.10-7.el8ap
0:2.5.10-7.el8ap
automation-gateway-proxy-server-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:2.5.10-7.el8ap
0:2.5.10-7.el8ap
automation-gateway-proxy
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:2.6.17-2.el9ap
0:2.6.17-2.el9ap
automation-gateway-proxy-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:2.6.17-2.el9ap
0:2.6.17-2.el9ap
automation-gateway-proxy-server-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:2.6.17-2.el9ap
0:2.6.17-2.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el8ap
0:1.6.7-1.el8ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el8ap
0:1.6.7-1.el8ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el8ap
0:1.6.7-1.el8ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el8ap
0:1.6.7-1.el8ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el8ap
0:1.6.7-1.el8ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
python3.12-daphne
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:4.2.2-1.el8ap
0:4.2.2-1.el8ap
python3.12-daphne
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:4.2.2-1.el9ap
0:4.2.2-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:4.6.31-1.el8ap
0:4.6.31-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:4.6.31-1.el9ap
0:4.6.31-1.el9ap
python3.12-pillow
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:12.3.0-1.el8ap
0:12.3.0-1.el8ap
python3.12-pillow
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:12.3.0-1.el9ap
0:12.3.0-1.el9ap
python3.12-pyasn1
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 17 CVEs
 before 0:0.6.4-1.el8ap
0:0.6.4-1.el8ap
python3.12-pyasn1
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 17 CVEs
 before 0:0.6.4-1.el9ap
0:0.6.4-1.el9ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.2.11-1.el9ap
0:1.2.11-1.el9ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.2.11-1.el9ap
0:1.2.11-1.el9ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.2.11-1.el9ap
0:1.2.11-1.el9ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.2.11-1.el9ap
0:1.2.11-1.el9ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.2.11-1.el9ap
0:1.2.11-1.el9ap
automation-gateway-proxy
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:2.6.17-2.el9ap
0:2.6.17-2.el9ap
automation-gateway-proxy-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:2.6.17-2.el9ap
0:2.6.17-2.el9ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:2.6.17-2.el9ap
0:2.6.17-2.el9ap
automation-gateway-proxy-server-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:2.6.17-2.el9ap
0:2.6.17-2.el9ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:3.14.1-2.el9ap
0:3.14.1-2.el9ap
python3.12-aiohttp-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:3.14.1-2.el9ap
0:3.14.1-2.el9ap
python3.12-aiohttp-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:3.14.1-2.el9ap
0:3.14.1-2.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el10ap
0:1.6.7-1.el10ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el10ap
0:1.6.7-1.el10ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el10ap
0:1.6.7-1.el10ap
receptorctl
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el10ap
0:1.6.7-1.el10ap
receptor
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:1.6.7-1.el9ap
0:1.6.7-1.el9ap
python3.12-daphne
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:4.2.2-1.el9ap
0:4.2.2-1.el9ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 17 CVEs
 before 0:4.7.15-2.el9ap
0:4.7.15-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 17 CVEs
 before 0:4.7.15-2.el9ap
0:4.7.15-2.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:4.7.15-2.el9ap
0:4.7.15-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:4.7.15-2.el9ap
0:4.7.15-2.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:4.7.15-2.el9ap
0:4.7.15-2.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:4.7.15-2.el9ap
0:4.7.15-2.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:4.7.15-2.el9ap
0:4.7.15-2.el9ap
python3.12-pillow
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:12.3.0-1.el9ap
0:12.3.0-1.el9ap
python3.12-pillow-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:12.3.0-1.el9ap
0:12.3.0-1.el9ap
python3.12-pillow-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:12.3.0-1.el9ap
0:12.3.0-1.el9ap
python3.12-pyasn1
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 17 CVEs
 before 0:0.6.4-1.el9ap
0:0.6.4-1.el9ap
python3.12-django
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el8ap
0:5.2.17-1.el8ap
python3.12-django
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el8ap
0:5.2.17-1.el8ap
python3.12-django
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
python3.12-django
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el8ap
0:4.6.32-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el9ap
0:4.6.32-1.el9ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:2.5.20260824-1.el8ap
0:2.5.20260824-1.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:2.5.20260824-1.el9ap
0:2.5.20260824-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el8ap
0:4.6.32-1.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el8ap
0:4.6.32-1.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el9ap
0:4.6.32-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el9ap
0:4.6.32-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:3.1.59-1.el8ap
0:3.1.59-1.el8ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:3.1.59-1.el9ap
0:3.1.59-1.el9ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:3.14.3-1.el8ap
0:3.14.3-1.el8ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:2.6.13-1.el9ap
0:2.6.13-1.el9ap
python-django
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python3-django
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python-django
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python3-django
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python3.12-django
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
python3.12-django
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:4.7.16-1.el9ap
0:4.7.16-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 20 CVEs
 before 0:4.7.16-1.el9ap
0:4.7.16-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:4.7.16-1.el9ap
0:4.7.16-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.1.59-1.el9ap
0:3.1.59-1.el9ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap
python3.12-aiohttp-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap
python3.12-aiohttp-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap
openvox-server
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:8.15.2-1.el8sat
0:8.15.2-1.el8sat
openvox-server
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:8.15.2-1.el8sat
0:8.15.2-1.el8sat
openvox-server
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
openvox-server
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
python-aiohttp
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python-aiohttp-debugsource
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python3.11-aiohttp
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python3.11-aiohttp-debuginfo
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python-aiohttp
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python-aiohttp-debugsource
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python3.11-aiohttp
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python3.11-aiohttp-debuginfo
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el8pc
0:3.14.3-1.el8pc
python-aiohttp
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp-debugsource
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp-debuginfo
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp-debugsource
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp-debuginfo
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
rubygem-jwt
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el8sat
0:2.10.3-1.el8sat
rubygem-jwt
Red Hat:satellite_utils:6.16::el8
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el8sat
0:2.10.3-1.el8sat
rubygem-jwt
Red Hat:satellite:6.16::el8
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el8sat
0:2.10.3-1.el8sat
rubygem-jwt
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite_utils:6.16::el9
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite:6.16::el9
From an advisory covering 7 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
openvox-server
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
openvox-server
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
ansible-core
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-core
Red Hat:satellite_maintenance:6.19::el9
From an advisory covering 22 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-core
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
python3.12-aiohttp
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debuginfo
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debugsource
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debuginfo
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debugsource
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-gitpython
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.1.59-1.el9pc
0:3.1.59-1.el9pc
python3.12-gitpython
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:3.1.59-1.el9pc
0:3.1.59-1.el9pc
rubygem-jwt
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 22 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite_utils:6.19::el9
From an advisory covering 22 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite:6.19::el9
From an advisory covering 22 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
openvox-server
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
pulpcore-obsolete-packages
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:1.3.1-5.el9pc
0:1.3.1-5.el9pc
python3.12-pulpcore
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.73.30-3.el9pc
0:3.73.30-3.el9pc
openvox-server
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
pulpcore-obsolete-packages
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:1.3.1-5.el9pc
0:1.3.1-5.el9pc
python3.12-pulpcore
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.73.30-3.el9pc
0:3.73.30-3.el9pc
ansible-core
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-core
Red Hat:satellite_maintenance:6.18::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-core
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
python3.12-aiohttp
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debuginfo
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debugsource
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debuginfo
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.12-aiohttp-debugsource
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
rubygem-jwt
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite_utils:6.18::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite:6.18::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
ansible-core
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
openvox-server
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
ansible-core
Red Hat:satellite_maintenance:6.17::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-core
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
ansible-test
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 1:2.16.19-1.el9sat
1:2.16.19-1.el9sat
openvox-server
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:8.15.2-1.el9sat
0:8.15.2-1.el9sat
python-aiohttp
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp-debugsource
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp-debuginfo
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python-aiohttp-debugsource
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
python3.11-aiohttp-debuginfo
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:3.14.3-1.el9pc
0:3.14.3-1.el9pc
rubygem-jwt
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite_utils:6.17::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
rubygem-jwt
Red Hat:satellite:6.17::el9
From an advisory covering 9 CVEs
 before 0:2.10.3-1.el9sat
0:2.10.3-1.el9sat
aiohttp
Root:PyPI
 before 3.8.6+aikido.1
3.8.6+aikido.13.10.11+aikido.53.12.15+aikido.33.10.11+aikido.63.10.11+aikido.73.13.5+aikido.13.12.15+aikido.43.12.15+aikido.53.12.15+aikido.63.8.6+aikido.23.8.6+aikido.33.10.11+aikido.83.13.5+aikido.23.13.4+aikido.13.13.3+aikido.113.13.4+aikido.23.8.6+aikido.43.12.14+aikido.53.8.6+aikido.53.8.6+aikido.63.8.6+aikido.73.8.6+aikido.83.8.6+aikido.93.12.14+aikido.63.13.5+aikido.33.8.6+aikido.103.13.3+aikido.123.13.4+aikido.33.10.11+aikido.93.13.3+aikido.133.13.4+aikido.43.8.6+aikido.113.12.14+aikido.73.8.6+aikido.123.13.5+aikido.43.8.6+aikido.133.13.3+aikido.143.12.14+aikido.83.13.4+aikido.53.12.15+aikido.73.10.11+aikido.103.13.3+aikido.153.13.4+aikido.63.12.15+aikido.83.13.5+aikido.53.10.11+aikido.113.10.11+aikido.123.8.6+aikido.143.12.15+aikido.93.12.14+aikido.93.13.5+aikido.63.13.3+aikido.163.13.4+aikido.73.8.6+aikido.15
python-aiohttp
SUSE:Linux Enterprise Server 16.0
From an advisory covering 11 CVEs
 before 3.11.16-160000.5.1
3.11.16-160000.5.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 11 CVEs
 before 3.11.16-160000.5.1
3.11.16-160000.5.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 11 CVEs
 before 3.6.0-150100.3.35.1
3.6.0-150100.3.35.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 11 CVEs
 before 3.6.0-150100.3.35.1
3.6.0-150100.3.35.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 11 CVEs
 before 3.6.0-150100.3.35.1
3.6.0-150100.3.35.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 11 CVEs
 before 3.6.0-150100.3.35.1
3.6.0-150100.3.35.1
python-aiohttp
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Module for Python 3 15 SP7
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 19 CVEs
 before 3.9.3-150400.10.43.1
3.9.3-150400.10.43.1
python-aiohttp
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.17.2-10.17.4-10.17.4-1build10.20.2-10.20.2-1ubuntu0.1~esm1
 None known
python-aiohttp
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.3-1build12.2.3-22.3.6-13.0.1-13.0.1-1ubuntu0.1~esm1
Show 4 moreShow less
3.0.1-1ubuntu0.1~esm43.0.1-1ubuntu0.1~esm53.0.1-1ubuntu0.1~esm63.0.1-1ubuntu0.1~esm7
 None known
python-aiohttp
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.5.4-13.5.4-1build13.6.1-13.6.2-13.6.2-1build1
Show 7 moreShow less
3.6.2-1ubuntu0.1~esm13.6.2-1ubuntu13.6.2-1ubuntu1+esm13.6.2-1ubuntu1+esm33.6.2-1ubuntu1+esm43.6.2-1ubuntu1+esm53.6.2-1ubuntu1+esm6
 None known
python-aiohttp
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.7.4-13.7.4-1build23.8.1-33.8.1-43.8.1-4build1
Show 4 moreShow less
3.8.1-4ubuntu0.23.8.1-4ubuntu0.2+esm13.8.1-4ubuntu0.2+esm23.8.1-4ubuntu0.2+esm3
 None known
python-aiohttp
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.8.4-13.9.1-13.9.1-1build13.9.1-1ubuntu0.13.9.1-1ubuntu0.1+esm13.9.1-1ubuntu0.1+esm23.9.1-1ubuntu0.1+esm3
 None known
python-aiohttp
Ubuntu:25.10
 All versions, plus listed versions
3.10.11-1build13.11.16-13.11.16-1ubuntu0.1
 None known
python-aiohttp
Ubuntu:26.10
 All versions, plus listed versions
3.13.3-3ubuntu13.14.1-43.14.1-53.14.3-1
 None known
python-aiohttp
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
3.11.16-13.13.1-13.13.3-33.13.3-3ubuntu13.13.3-3ubuntu1+esm1
 None known
python-aiohttp
openSUSE:Tumbleweed
 before 3.14.0-1.1
3.14.0-1.1
python-aiohttp
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 3.11.16-160000.5.1
3.11.16-160000.5.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34993 is a medium vulnerability (CVSS 6.4) in Aio-libs Aiohttp, published June 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in aiohttp 3.14.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 256 versions and 235 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open