{"id":"CVE-2023-47627","aliases":["AZL-43882","AZL-44370","CLSA-2025-1753402388","CLSA-2025-1756253594","CLSA-2025-1758759236","CLSA-2026-1791459385","DEBIAN-CVE-2023-47627","DLA-4041-1","DSA-5828-1","EUVD-2023-0004","GHSA-gfw2-4jvh-wgfg","OESA-2025-1250","OESA-2025-1346","OESA-2025-1347","PYSEC-2023-246","RHSA-2024:1057","RHSA-2024:1536","RHSA-2024:1640","RHSA-2024:1878","RHSA-2024:2010","SUSE-SU-2024:0577-1","UBUNTU-CVE-2023-47627","USN-7642-1","openSUSE-SU-2024:13465-1","openSUSE-SU-2026:11467-1"],"status":"published","title":"Request smuggling in aiohttp","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00857,"percentile":0.58855,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2023-11-14T20:48:48Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"PyPI","package":"aiohttp","fixed_in":["3.8.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:PyPI","package":"aiohttp","fixed_in":["3.8.1.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-aiohttp","fixed_in":["3.8.4-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-aiohttp","fixed_in":["3.8.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-aiohttp","fixed_in":["3.8.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-aiohttp","fixed_in":["3.8.1-4ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-aiohttp","fixed_in":["3.9.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.2-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.2-3"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.5"},{"fixed":"3.8.5.post1+tuxcare"}]}],"versions":["3.8.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.1"},{"fixed":"3.8.1.post1+tuxcare"}]}],"versions":["3.8.1"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.4"},{"fixed":"3.8.4.post15+tuxcare"}]}],"versions":["3.8.4","3.8.4.post1+tuxcare","3.8.4.post10+tuxcare","3.8.4.post11+tuxcare","3.8.4.post12+tuxcare","3.8.4.post13+tuxcare","3.8.4.post14+tuxcare","3.8.4.post2+tuxcare","3.8.4.post3+tuxcare","3.8.4.post4+tuxcare","3.8.4.post5+tuxcare","3.8.4.post6+tuxcare","3.8.4.post7+tuxcare","3.8.4.post8+tuxcare","3.8.4.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1+deb12u1"}]}],"versions":["3.8.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-1+deb11u1"}]}],"versions":["3.7.4-1"],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1+deb12u1"}]}],"versions":["3.8.4-1"],"bundled":6},{"source":"osv","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.2","0.20.0","0.20.1","0.20.2","0.21.0","0.21.1","0.21.2","0.21.4","0.21.5","0.21.6","0.22.0","0.22.0a0","0.22.0b0","0.22.0b1","0.22.0b2","0.22.0b3","0.22.0b4","0.22.0b5","0.22.0b6","0.22.1","0.22.2","0.22.3","0.22.4","0.22.5","0.3","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","2.0.0","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.0a1","2.3.0a2","2.3.0a3","2.3.0a4","2.3.1","2.3.10","2.3.1a1","2.3.2","2.3.2b2","2.3.2b3","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0b0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.2.0","3.2.1","3.3.0","3.3.0a0","3.3.1","3.3.2","3.3.2a0","3.4.0","3.4.0a0","3.4.0a3","3.4.0b1","3.4.0b2","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0a1","3.5.0b1","3.5.0b2","3.5.0b3","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0a0","3.6.0a1","3.6.0a11","3.6.0a12","3.6.0a2","3.6.0a3","3.6.0a4","3.6.0a5","3.6.0a6","3.6.0a7","3.6.0a8","3.6.0a9","3.6.0b0","3.6.1","3.6.1b3","3.6.1b4","3.6.2","3.6.2a0","3.6.2a1","3.6.2a2","3.6.3","3.7.0","3.7.0b0","3.7.0b1","3.7.1","3.7.2","3.7.3","3.7.4","3.7.4.post0","3.8.0","3.8.0a7","3.8.0b0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-5.oe2003sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-6.oe2203sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-6.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"d5c12ba890557a575c313bb3017910d7616fce3d"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.2","0.20.0","0.20.1","0.20.2","0.21.0","0.21.1","0.21.2","0.21.4","0.21.5","0.21.6","0.22.0","0.22.0a0","0.22.0b0","0.22.0b1","0.22.0b2","0.22.0b3","0.22.0b4","0.22.0b5","0.22.0b6","0.22.1","0.22.2","0.22.3","0.22.4","0.22.5","0.3","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","2.0.0","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.0a1","2.3.0a2","2.3.0a3","2.3.0a4","2.3.1","2.3.10","2.3.1a1","2.3.2","2.3.2b2","2.3.2b3","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0b0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.2.0","3.2.1","3.3.0","3.3.0a0","3.3.1","3.3.2","3.3.2a0","3.4.0","3.4.0a0","3.4.0a3","3.4.0b1","3.4.0b2","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0a1","3.5.0b1","3.5.0b2","3.5.0b3","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0a0","3.6.0a1","3.6.0a11","3.6.0a12","3.6.0a2","3.6.0a3","3.6.0a4","3.6.0a5","3.6.0a6","3.6.0a7","3.6.0a8","3.6.0a9","3.6.0b0","3.6.1","3.6.1b3","3.6.1b4","3.6.2","3.6.2a0","3.6.2a1","3.6.2a2","3.6.3","3.7.0","3.7.0b0","3.7.0b1","3.7.1","3.7.2","3.7.3","3.7.4","3.7.4.post0","3.8.0","3.8.0a7","3.8.0b0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python3x-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python39-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python3x-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python3-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.2-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.1-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.1-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.1-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.1-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.1-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.1-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.1-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.1-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-pycryptodomex-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-pycryptodomex-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-pycryptodomex-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-pycryptodomex-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"ansible-automation-platform-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4-6.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"ansible-rulebook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-eda-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-eda-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"ansible-automation-platform-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4-6.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"ansible-rulebook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-eda-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-eda-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python3x-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python39-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python3x-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python3-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.10-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.10-1.el8ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.10-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.10-1.el9ap"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.18-2.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.18-2.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.18-2.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.18-2.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.22-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.22-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.22-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.22-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-0.1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.5-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.5-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:41.0.6-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:41.0.6-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:41.0.6-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:41.0.6-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python-ecdsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.18.0-4.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhui:4::el8","package":"python3.11-ecdsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.18.0-4.el8ui"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.15::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.15::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.19-2.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.19-2.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.19-2.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.19-2.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"puppetserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.0-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"puppetserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.0-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.9-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.9-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.9-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.9-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-pycryptodomex-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-pycryptodomex-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-pycryptodomex-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-pycryptodomex-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-puma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-puma-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-audited","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.2-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.3-1build1","2.2.3-2","2.3.6-1","3.0.1-1","3.0.1-1ubuntu0.1~esm1","3.0.1-1ubuntu0.1~esm4","3.0.1-1ubuntu0.1~esm5","3.0.1-1ubuntu0.1~esm6","3.0.1-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-4ubuntu0.2+esm1"}]}],"versions":["3.7.4-1","3.7.4-1build2","3.8.1-3","3.8.1-4","3.8.1-4build1","3.8.1-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1ubuntu0.1~esm5"}]}],"versions":["2.2.3-1build1","2.2.3-2","2.3.6-1","3.0.1-1","3.0.1-1ubuntu0.1~esm1","3.0.1-1ubuntu0.1~esm4"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1ubuntu1+esm4"}]}],"versions":["3.5.4-1","3.5.4-1build1","3.6.1-1","3.6.2-1","3.6.2-1build1","3.6.2-1ubuntu0.1~esm1","3.6.2-1ubuntu1","3.6.2-1ubuntu1+esm1","3.6.2-1ubuntu1+esm3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-4ubuntu0.2+esm1"}]}],"versions":["3.7.4-1","3.7.4-1build2","3.8.1-3","3.8.1-4","3.8.1-4build1","3.8.1-4ubuntu0.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-1ubuntu0.1+esm1"}]}],"versions":["3.8.4-1","3.9.1-1","3.9.1-1build1","3.9.1-1ubuntu0.1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.3-1.1"}]}],"bundled":10}],"products":[{"vendor":"aio-libs","product":"aiohttp"},{"vendor":"aiohttp","product":"aiohttp"}],"references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDKQ6HM3KNDU4OQI476ZWT4O7DMSIT35/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQYQL6WV535EEKSNH7KRARLLMOW5WXDM/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUSJVQ7OQ55RWL4XAX2F5EZ73N4ZSH6U/","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47627","tags":["web","advisory"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.8.6","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-246.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUSJVQ7OQ55RWL4XAX2F5EZ73N4ZSH6U","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDKQ6HM3KNDU4OQI476ZWT4O7DMSIT35","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQYQL6WV535EEKSNH7KRARLLMOW5WXDM","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gfw2-4jvh-wgfg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47627.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-47627","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1250","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30251","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1346","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1347","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1057","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265085","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1057.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40896","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40896","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44271","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44271","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44271","tags":["advisory"]},{"url":"https://devhub.checkmarx.com/cve-details/CVE-2023-44271/","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/pull/7244","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-47627","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-47627","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-49081","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49081","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49081","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-49082","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49082","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-qvrw-v9rv-5rjx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-52323","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52323","tags":["advisory"]},{"url":"https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst","tags":["article"]},{"url":"https://pypi.org/project/pycryptodomex/#history","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1657","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1657","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1657","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22195","tags":["advisory"]},{"url":"https://github.com/pallets/jinja/releases/tag/3.1.3","tags":["article"]},{"url":"https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24680","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24680","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xxj9-f6rv-m3x4","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/feb/06/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1536","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_and_updating_red_hat_satellite/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2234387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266113","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266140","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266147","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266149","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266413","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1536.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5189","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5189","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-43665","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-43665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43665","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2023/oct/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23334","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23334","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23829","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23829","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1640","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247040","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266045","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1640.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39326","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39326","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2382","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41040","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45857","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46137","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-49083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49083","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/9926","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1394","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1394","tags":["advisory"]},{"url":"https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136","tags":["article"]},{"url":"https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6","tags":["article"]},{"url":"https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2660","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2024-2660.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27351","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27351","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/mar/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1878","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224185","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259780","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHUI-434","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHUI-514","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHUI-516","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1878.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-36053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36053","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2023/jul/03/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-37276","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-37276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37276","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41164","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41164","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41164","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2023/sep/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23342","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23342","tags":["advisory"]},{"url":"https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md","tags":["article"]},{"url":"https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp","tags":["article"]},{"url":"https://minerva.crocs.fi.muni.cz/","tags":["article"]},{"url":"https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2010","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251014","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252064","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253618","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253621","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254612","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255026","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256411","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256452","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256473","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256604","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256683","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257957","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258876","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2263243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2263815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2267949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1393613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1792187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1884395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937203","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964539","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1967073","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1976178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1976213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992495","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048805","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2068263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2068527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2071097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087537","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2091900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2096930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106256","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121957","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2126357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2126420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129296","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2131798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2138905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2141421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2144615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2148439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2148534","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2149288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2152709","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153548","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155083","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158524","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2160160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2162637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2162882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2166428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168173","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172083","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172094","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175132","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2181595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2181991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2188287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2192939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2193010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2203077","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2208310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2208557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2208588","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2209968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2214285","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2214331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216006","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216017","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2221673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223567","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224170","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225534","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2226714","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2229095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2229810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231814","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232500","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2233162","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2233490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2234467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236418","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238906","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238952","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239549","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2240243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2240956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241017","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242812","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243256","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248864","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249904","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249970","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2010.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4320","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4320","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-36479","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36479","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38037","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2023-38037.yml","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40167","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110#section-8.6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21647","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21647","tags":["advisory"]},{"url":"https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22047","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240577-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217174","tags":["report"]},{"url":"https://bugzilla.suse.com/1217181","tags":["report"]},{"url":"https://bugzilla.suse.com/1217782","tags":["report"]},{"url":"https://bugzilla.suse.com/1219341","tags":["report"]},{"url":"https://bugzilla.suse.com/1219342","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23829","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-47627","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7642-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-49081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-49082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-23829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-30251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-52304","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69244","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-47627","title":"Request smuggling in aiohttp","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.","status":"published","published":"2023-11-14T20:48:48.076Z","modified":"2025-11-03T20:36:06.806Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:35:14.298866Z"}],"euvd":[{"id":"EUVD-2023-0004","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.","status":"published","published":"2023-11-14T20:48:48Z","modified":"2025-11-03T20:36:06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:32.503916Z"}],"ghsa":[{"id":"GHSA-gfw2-4jvh-wgfg","title":"AIOHTTP has problems in HTTP parser (the python one, not llhttp)","description":"# Summary\nThe HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling.\nThis parser is only used when `AIOHTTP_NO_EXTENSIONS` is enabled (or not using a prebuilt wheel).\n \n# Details\n\n## Bug 1: Bad parsing of `Content-Length` values\n\n### Description\nRFC 9110 says this:\n\u003e `Content-Length = 1*DIGIT`\n\nAIOHTTP does not enforce this rule, presumably because of an incorrect usage of the builtin `int` constructor. Because the `int` constructor accepts `+` and `-` prefixes, and digit-separating underscores, using `int` to parse CL values leads AIOHTTP to significant misinterpretation.\n\n### Examples\n```\nGET / HTTP/1.1\\r\\n\nContent-Length: -0\\r\\n\n\\r\\n\nX\n```\n```\nGET / HTTP/1.1\\r\\n\nContent-Length: +0_1\\r\\n\n\\r\\n\nX\n```\n\n### Suggested action\nVerify that a `Content-Length` value consists only of ASCII digits before parsing, as the standard requires.\n\n## Bug 2: Improper handling of NUL, CR, and LF in header values\n\n### Description\nRFC 9110 says this:\n\u003e Field values containing CR, LF, or NUL characters are invalid and dangerous, due to the varying ways that implementations might parse and interpret those characters; a recipient of CR, LF, or NUL within a field value MUST either reject the message or replace each of those characters with SP before further processing or forwarding of that message.\n\nAIOHTTP's HTTP parser does not enforce this rule, and will happily process header values containing these three forbidden characters without replacing them with SP.\n### Examples\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\x00alue\\r\\n\n\\r\\n\n```\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\ralue\\r\\n\n\\r\\n\n```\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\nalue\\r\\n\n\\r\\n\n```\n### Suggested action\nReject all messages with NUL, CR, or LF in a header value. The translation to space thing, while technically allowed, does not seem like a good idea to me.\n\n## Bug 3: Improper stripping of whitespace before colon in HTTP headers\n\n### Description\nRFC 9112 says this:\n\u003e No whitespace is allowed between the field name and colon. In the past, differences in the handling of such whitespace have led to security vulnerabilities in request routing and response handling. A server MUST reject, with a response status code of 400 (Bad Request), any received request message that contains whitespace between a header field name and colon.\n\nAIOHTTP does not enforce this rule, and will simply strip any whitespace before the colon in an HTTP header.\n\n### Example\n```\nGET / HTTP/1.1\\r\\n\nContent-Length : 1\\r\\n\n\\r\\n\nX\n```\n\n### Suggested action\nReject all messages with whitespace before a colon in a header field, as the standard requires.\n\n# PoC\nExample requests are embedded in the previous section. To reproduce these bugs, start an AIOHTTP server without llhttp (i.e. `AIOHTTP_NO_EXTENSIONS=1`) and send the requests given in the previous section. (e.g. by `printf`ing into `nc`)\n\n# Impact\nEach of these bugs can be used for request smuggling.","status":"published","published":"2023-11-14T22:20:59Z","modified":"2025-11-03T22:31:22Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2023-47627","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.","status":"published","published":"2023-11-14T21:15:12.82Z","modified":"2026-06-17T06:33:00.39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:08:46.647045Z"}],"osv":[{"id":"AZL-43882","title":"CVE-2023-47627 affecting package python-aiohttp 3.6.2-3","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.","status":"published","published":"2023-11-14T21:15:12Z","modified":"2026-04-21T04:31:11.977595Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44370","title":"CVE-2023-47627 affecting package python-aiohttp 3.6.2-3","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.","status":"published","published":"2023-11-14T21:15:12Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2023-47627","title":"Request smuggling in aiohttp","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.","status":"published","published":"2023-11-14T20:48:48.076Z","modified":"2026-10-28T02:30:53.110409373Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-47627","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.","status":"published","published":"2023-11-14T21:15:12.82Z","modified":"2026-10-26T18:02:50.080517296Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"GHSA-gfw2-4jvh-wgfg","title":"AIOHTTP has problems in HTTP parser (the python one, not llhttp)","description":"# Summary\nThe HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling.\nThis parser is only used when `AIOHTTP_NO_EXTENSIONS` is enabled (or not using a prebuilt wheel).\n \n# Details\n\n## Bug 1: Bad parsing of `Content-Length` values\n\n### Description\nRFC 9110 says this:\n\u003e `Content-Length = 1*DIGIT`\n\nAIOHTTP does not enforce this rule, presumably because of an incorrect usage of the builtin `int` constructor. Because the `int` constructor accepts `+` and `-` prefixes, and digit-separating underscores, using `int` to parse CL values leads AIOHTTP to significant misinterpretation.\n\n### Examples\n```\nGET / HTTP/1.1\\r\\n\nContent-Length: -0\\r\\n\n\\r\\n\nX\n```\n```\nGET / HTTP/1.1\\r\\n\nContent-Length: +0_1\\r\\n\n\\r\\n\nX\n```\n\n### Suggested action\nVerify that a `Content-Length` value consists only of ASCII digits before parsing, as the standard requires.\n\n## Bug 2: Improper handling of NUL, CR, and LF in header values\n\n### Description\nRFC 9110 says this:\n\u003e Field values containing CR, LF, or NUL characters are invalid and dangerous, due to the varying ways that implementations might parse and interpret those characters; a recipient of CR, LF, or NUL within a field value MUST either reject the message or replace each of those characters with SP before further processing or forwarding of that message.\n\nAIOHTTP's HTTP parser does not enforce this rule, and will happily process header values containing these three forbidden characters without replacing them with SP.\n### Examples\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\x00alue\\r\\n\n\\r\\n\n```\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\ralue\\r\\n\n\\r\\n\n```\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\nalue\\r\\n\n\\r\\n\n```\n### Suggested action\nReject all messages with NUL, CR, or LF in a header value. The translation to space thing, while technically allowed, does not seem like a good idea to me.\n\n## Bug 3: Improper stripping of whitespace before colon in HTTP headers\n\n### Description\nRFC 9112 says this:\n\u003e No whitespace is allowed between the field name and colon. In the past, differences in the handling of such whitespace have led to security vulnerabilities in request routing and response handling. A server MUST reject, with a response status code of 400 (Bad Request), any received request message that contains whitespace between a header field name and colon.\n\nAIOHTTP does not enforce this rule, and will simply strip any whitespace before the colon in an HTTP header.\n\n### Example\n```\nGET / HTTP/1.1\\r\\n\nContent-Length : 1\\r\\n\n\\r\\n\nX\n```\n\n### Suggested action\nReject all messages with whitespace before a colon in a header field, as the standard requires.\n\n# PoC\nExample requests are embedded in the previous section. To reproduce these bugs, start an AIOHTTP server without llhttp (i.e. `AIOHTTP_NO_EXTENSIONS=1`) and send the requests given in the previous section. (e.g. by `printf`ing into `nc`)\n\n# Impact\nEach of these bugs can be used for request smuggling.","status":"published","published":"2023-11-14T22:20:59Z","modified":"2026-09-10T03:49:59.098190473Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"OESA-2025-1250","title":"python-aiohttp security update","description":"Async http client/server framework (asyncio).\r\n\r\nSecurity Fix(es):\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.(CVE-2023-47627)\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.(CVE-2023-49082)\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option \u0026apos;follow_symlinks\u0026apos; can be used to determine whether to follow symbolic links outside the static root directory. When \u0026apos;follow_symlinks\u0026apos; is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present.  Disabling follow_symlinks and using a reverse proxy are encouraged mitigations.  Version 3.9.2 fixes this issue.(CVE-2024-23334)\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input.  Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.(CVE-2024-23829)\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.(CVE-2024-27306)\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.(CVE-2024-30251)","status":"published","published":"2025-03-07T11:08:21Z","modified":"2026-08-18T01:18:48.603531674Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1346","title":"python-aiohttp security update","description":"Async http client/server framework (asyncio).\r\n\r\nSecurity Fix(es):\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.(CVE-2023-47627)\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.(CVE-2023-49082)\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input.  Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.(CVE-2024-23829)","status":"published","published":"2025-03-29T11:08:26Z","modified":"2026-08-18T01:17:50.908323015Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1347","title":"python-aiohttp security update","description":"Async http client/server framework (asyncio).\r\n\r\nSecurity Fix(es):\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.(CVE-2023-47627)\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.(CVE-2023-49082)\n\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input.  Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.(CVE-2024-23829)","status":"published","published":"2025-03-29T11:08:26Z","modified":"2026-08-18T01:17:50.645741792Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"PYSEC-2023-246","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.","status":"published","published":"2023-11-14T21:15:00Z","modified":"2023-11-22T23:41:28.136683Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"RHSA-2024:1057","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-09-30T15:56:28Z","modified":"2026-10-09T10:09:15Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1536","title":"Red Hat Security Advisory: Satellite 6.14.3 Async Security Update","status":"published","published":"2024-09-18T05:49:45Z","modified":"2026-09-09T10:03:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1640","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-09-30T15:52:23Z","modified":"2026-10-18T10:02:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1878","title":"Red Hat Security Advisory: RHUI 4.8 Release - Security Updates, Bug Fixes, and Enhancements","status":"published","published":"2024-09-28T04:02:33Z","modified":"2026-09-09T10:03:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2010","title":"Red Hat Security Advisory: Satellite 6.15.0 release","status":"published","published":"2024-09-30T15:58:05Z","modified":"2026-10-13T10:06:37Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2023-47627","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.","status":"published","published":"2023-11-14T21:15:00Z","modified":"2026-07-23T01:15:15.098902732Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"CLSA-2025-1753402388","title":"TuxCare security update for aiohttp (2 CVEs)","description":"TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.5.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:48:04.780744241Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1756253594","title":"TuxCare security update for aiohttp (1 CVE)","description":"TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.1.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:48:04.915915289Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1758759236","title":"TuxCare security update for orjson (2 CVEs)","description":"TuxCare rebuilt orjson to address 2 CVEs. Fixed in 3.8.5.post1+tuxcare.","status":"withdrawn","published":"2026-08-04T14:52:11Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1791459385","title":"TuxCare security update for aiohttp (2 CVEs)","description":"TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.4.post15+tuxcare.","status":"published","published":"2026-10-08T11:36:25Z","modified":"2026-10-15T09:48:02.36249359Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"DLA-4041-1","title":"python-aiohttp - security update","status":"published","published":"2025-02-03T00:00:00Z","modified":"2026-03-09T01:20:42.144661Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5828-1","title":"python-aiohttp - security update","status":"published","published":"2024-12-11T00:00:00Z","modified":"2026-03-09T02:10:30.020137Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:13465-1","title":"python310-aiohttp-3.9.0-1.1 on GA media","description":"These are all security issues fixed in the python310-aiohttp-3.9.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:03:14.69874Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2026:11467-1","title":"python313-aiohttp-3.14.3-1.1 on GA media","description":"These are all security issues fixed in the python313-aiohttp-3.14.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-06T00:00:00Z","modified":"2026-08-07T10:00:44.119328568Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"SUSE-SU-2024:0577-1","title":"Security update for python-aiohttp, python-time-machine","description":"This update for python-aiohttp, python-time-machine fixes the following issues:\n\npython-aiohttp was updated to version 3.9.3:\n\n* Fixed backwards compatibility breakage (in 3.9.2) of ``ssl`` parameter\n  when set outside of ``ClientSession`` (e.g. directly in ``TCPConnector``)\n* Improved test suite handling of paths and temp files to consistently\n  use pathlib and pytest fixtures.\n\nFrom version 3.9.2 (bsc#1219341, CVE-2024-23334, bsc#1219342, CVE-2024-23829):\n\n* Fixed server-side websocket connection leak.\n* Fixed ``web.FileResponse`` doing blocking I/O in the event loop.\n* Fixed double compress when compression enabled and compressed file\n  exists in server file responses.\n* Added runtime type check for ``ClientSession`` ``timeout`` parameter.\n* Fixed an unhandled exception in the Python HTTP parser on header lines\n  starting with a colon.\n* Improved validation of paths for static resources requests to the server.\n* Added support for passing :py:data:`True` to ``ssl`` parameter in\n  ``ClientSession`` while deprecating :py:data:`None`.\n* Fixed an unhandled exception in the Python HTTP parser on header lines\n  starting with a colon.\n* Fixed examples of ``fallback_charset_resolver`` function in the\n  :doc:`client_advanced` document.\n* The Sphinx setup was updated to avoid showing the empty\n  changelog draft section in the tagged release documentation\n  builds on Read The Docs.\n* The changelog categorization was made clearer. The contributors can\n  now mark their fragment files more accurately.\n* Updated :ref:`contributing/Tests coverage \u003caiohttp-contributing\u003e`\n  section to show how we use ``codecov``.\n* Replaced all ``tmpdir`` fixtures with ``tmp_path`` in test suite.\n\n- Disable broken tests with openssl 3.2 and python \u003c 3.11 bsc#1217782\n\nupdate to 3.9.1:\n\n* Fixed importing aiohttp under PyPy on Windows.\n* Fixed async concurrency safety in websocket compressor.\n* Fixed ``ClientResponse.close()`` releasing the connection\n  instead of closing.\n* Fixed a regression where connection may get closed during\n  upgrade. -- by :user:`Dreamsorcerer`\n* Fixed messages being reported as upgraded without an Upgrade\n  header in Python parser. -- by :user:`Dreamsorcerer`\n\nupdate to 3.9.0: (bsc#1217684, CVE-2023-49081, bsc#1217682, CVE-2023-49082)\n\n* Introduced ``AppKey`` for static typing support of\n  ``Application`` storage.\n* Added a graceful shutdown period which allows pending tasks\n  to complete before the application's cleanup is called.\n* Added `handler_cancellation`_ parameter to cancel web handler on\n  client disconnection.\n* This (optionally) reintroduces a feature removed in a\n  previous release.\n* Recommended for those looking for an extra level of\n  protection against denial-of-service attacks.\n* Added support for setting response header parameters\n  ``max_line_size`` and ``max_field_size``.\n* Added ``auto_decompress`` parameter to\n  ``ClientSession.request`` to override\n  ``ClientSession._auto_decompress``.\n* Changed ``raise_for_status`` to allow a coroutine.\n* Added client brotli compression support (optional with\n  runtime check).\n* Added ``client_max_size`` to ``BaseRequest.clone()`` to allow\n  overriding the request body size. -- :user:`anesabml`.\n* Added a middleware type alias\n  ``aiohttp.typedefs.Middleware``.\n* Exported ``HTTPMove`` which can be used to catch any\n  redirection request that has a location -- :user:`dreamsorcerer`.\n* Changed the ``path`` parameter in ``web.run_app()`` to accept\n  a ``pathlib.Path`` object.\n* Performance: Skipped filtering ``CookieJar`` when the jar is\n  empty or all cookies have expired.\n* Performance: Only check origin if insecure scheme and there\n  are origins to treat as secure, in\n  ``CookieJar.filter_cookies()``.\n* Performance: Used timestamp instead of ``datetime`` to\n  achieve faster cookie expiration in ``CookieJar``.\n* Added support for passing a custom server name parameter to\n  HTTPS connection.\n* Added support for using Basic Auth credentials from\n  :file:`.netrc` file when making HTTP requests with the\n* :py:class:`~aiohttp.ClientSession` ``trust_env`` argument is\n  set to ``True``. -- by :user:`yuvipanda`.\n* Turned access log into no-op when the logger is disabled.\n* Added typing information to ``RawResponseMessage``. -- by\n  :user:`Gobot1234`\n* Removed ``async-timeout`` for Python 3.11+ (replaced with\n  ``asyncio.timeout()`` on newer releases).\n* Added support for ``brotlicffi`` as an alternative to\n  ``brotli`` (fixing Brotli support on PyPy).\n* Added ``WebSocketResponse.get_extra_info()`` to access a\n  protocol transport's extra info.\n* Allow ``link`` argument to be set to None/empty in HTTP 451\n  exception.\n* Fixed client timeout not working when incoming data is always\n  available without waiting. -- by :user:`Dreamsorcerer`.\n* Fixed ``readuntil`` to work with a delimiter of more than one\n  character.\n* Added ``__repr__`` to ``EmptyStreamReader`` to avoid\n  ``AttributeError``.\n* Fixed bug when using ``TCPConnector`` with\n  ``ttl_dns_cache=0``.\n* Fixed response returned from expect handler being thrown\n  away. -- by :user:`Dreamsorcerer`\n* Avoided raising ``UnicodeDecodeError`` in multipart and in\n  HTTP headers parsing.\n* Changed ``sock_read`` timeout to start after writing has\n  finished, avoiding read timeouts caused by an unfinished\n  write. -- by :user:`dtrifiro`\n* Fixed missing query in tracing method URLs when using\n  ``yarl`` 1.9+.\n* Changed max 32-bit timestamp to an aware datetime object, for\n  consistency with the non-32-bit one, and to avoid a\n  ``DeprecationWarning`` on Python 3.12.\n* Fixed ``EmptyStreamReader.iter_chunks()`` never ending.\n* Fixed a rare ``RuntimeError: await wasn't used with future``\n  exception.\n* Fixed issue with insufficient HTTP method and version\n  validation.\n* Added check to validate that absolute URIs have schemes.\n* Fixed unhandled exception when Python HTTP parser encounters\n  unpaired Unicode surrogates.\n* Updated parser to disallow invalid characters in header field\n  names and stop accepting LF as a request line separator.\n* Fixed Python HTTP parser not treating 204/304/1xx as an empty\n  body.\n* Ensure empty body response for 1xx/204/304 per RFC 9112 sec\n  6.3.\n* Fixed an issue when a client request is closed before\n  completing a chunked payload. -- by :user:`Dreamsorcerer`\n* Edge Case Handling for ResponseParser for missing reason\n  value.\n* Fixed ``ClientWebSocketResponse.close_code`` being\n  erroneously set to ``None`` when there are concurrent async\n  tasks receiving data and closing the connection.\n* Added HTTP method validation.\n* Fixed arbitrary sequence types being allowed to inject values\n  via version parameter. -- by :user:`Dreamsorcerer`\n* Performance: Fixed increase in latency with small messages\n  from websocket compression changes.\n* Improved Documentation\n* Fixed the `ClientResponse.release`'s type in the doc. Changed\n  from `comethod` to `method`.\n* Added information on behavior of base_url parameter in\n  `ClientSession`.\n* Completed ``trust_env`` parameter description to honor\n  ``wss_proxy``, ``ws_proxy`` or ``no_proxy`` env.\n* Dropped Python 3.6 support.\n* Dropped Python 3.7 support. -- by :user:`Dreamsorcerer`\n* Removed support for abandoned ``tokio`` event loop.\n* Made ``print`` argument in ``run_app()`` optional.\n* Improved performance of ``ceil_timeout`` in some cases.\n* Changed importing Gunicorn to happen on-demand, decreasing\n  import time by ~53%. -- :user:`Dreamsorcerer`\n* Improved import time by replacing ``http.server`` with\n  ``http.HTTPStatus``.\n* Fixed annotation of ``ssl`` parameter to disallow ``True``.\n\nupdate to 3.8.6 (bsc#1217181, CVE-2023-47627):\n\n* Security bugfixes\n* https://github.com/aio-libs/aiohttp/security/advisories/GHSA-\n  pjjw-qhg8-p2p9.\n* https://github.com/aio-libs/aiohttp/security/advisories/GHSA-\n  gfw2-4jvh-wgfg.\n* Added ``fallback_charset_resolver`` parameter in\n  ``ClientSession`` to allow a user-supplied\n  character set detection function.\n  Character set detection will no longer be included in 3.9 as\n  a default. If this feature is needed,\n  please use `fallback_charset_resolver\n  the client\n* Fixed ``PermissionError`` when ``.netrc`` is unreadable due\n  to permissions.\n* Fixed output of parsing errors\n* Fixed sorting in ``filter_cookies`` to use cookie with\n  longest path.\n\nRelease 3.8.0 (2021-10-31) (bsc#1217174, CVE-2023-47641)\n","status":"published","published":"2024-02-21T10:43:49Z","modified":"2026-02-04T04:09:07.337359Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-7642-1","title":"python-aiohttp vulnerabilities","description":"Ben Kallus discovered that AIOHTTP did not correctly parse HTTP\nheaders. A remote attacker could possibly use this issue to perform\nrequest smuggling. This issue only affected Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2023-47627)\n\nIvan Novikov discovered that AIOHTTP did not properly validate certain\ninputs. A remote attacker could possibly use this issue to perform request\nsmuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)\n\nPaul J. Dorn discovered that AIOHTTP did not properly validate certain\ninputs. A remote attacker could possibly use this issue to perform request\nsmuggling. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and\nUbuntu 24.04 LTS. (CVE-2024-23829)\n\nTakeshi Kaneko discovered that AIOHTTP did not properly sanitize certain\ninputs. A remote attacker could possibly use this issue to perform a\ncross-site scripting (XSS) attack. (CVE-2024-27306)\n\nIt was discovered that AIOHTTP did not correctly handle certain POST\nrequests. A remote attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30251)\n\nJeppe Bonde Weikop discovered that AIOHTTP did not correctly handle\nparsing newlines in certain inputs. A remote attacker could possibly use\nthis issue to perform request smuggling. (CVE-2024-52304)","status":"published","published":"2025-07-17T05:56:58Z","modified":"2026-04-27T18:09:38.15639Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}