{"id":"CVE-2026-50269","aliases":["AZL-90656","CLSA-2026-1784769519","CLSA-2026-1791372571","CLSA-2026-1791373745","CLSA-2026-1791377424","DEBIAN-CVE-2026-50269","EUVD-2026-38308","GHSA-m6qw-4cw2-hm4m","MGASA-2026-0584","PYSEC-2026-2106","SUSE-SU-2026:22819-1","SUSE-SU-2026:3207-1","SUSE-SU-2026:3208-1","UBUNTU-CVE-2026-50269","openSUSE-SU-2026:11097-1","openSUSE-SU-2026:21372-1"],"status":"published","title":"AIOHTTP: CRLF injection in multipart headers","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.","severity":{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00533,"percentile":0.45485,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-113","CWE-93"],"published":"2026-06-15T20:07:26Z","modified":"2026-11-09T16:58:28Z","fixes":[{"ecosystem":"PyPI","package":"aiohttp","fixed_in":["3.14.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-aiohttp","fixed_in":["3.8.4-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-aiohttp","fixed_in":["3.14.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.13.5"},{"fixed":"3.14.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.2-3"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.6"},{"fixed":"3.8.6.post7+tuxcare"}]}],"versions":["3.8.6","3.8.6.post1+tuxcare","3.8.6.post2+tuxcare","3.8.6.post3+tuxcare","3.8.6.post4+tuxcare","3.8.6.post5+tuxcare","3.8.6.post6+tuxcare"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.5"},{"fixed":"3.8.5.post18+tuxcare"}]}],"versions":["3.8.5","3.8.5.post1+tuxcare","3.8.5.post10+tuxcare","3.8.5.post11+tuxcare","3.8.5.post12+tuxcare","3.8.5.post13+tuxcare","3.8.5.post14+tuxcare","3.8.5.post15+tuxcare","3.8.5.post16+tuxcare","3.8.5.post17+tuxcare","3.8.5.post2+tuxcare","3.8.5.post3+tuxcare","3.8.5.post4+tuxcare","3.8.5.post5+tuxcare","3.8.5.post6+tuxcare","3.8.5.post7+tuxcare","3.8.5.post8+tuxcare","3.8.5.post9+tuxcare"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.4"},{"fixed":"3.8.4.post14+tuxcare"}]}],"versions":["3.8.4","3.8.4.post1+tuxcare","3.8.4.post10+tuxcare","3.8.4.post11+tuxcare","3.8.4.post12+tuxcare","3.8.4.post13+tuxcare","3.8.4.post2+tuxcare","3.8.4.post3+tuxcare","3.8.4.post4+tuxcare","3.8.4.post5+tuxcare","3.8.4.post6+tuxcare","3.8.4.post7+tuxcare","3.8.4.post8+tuxcare","3.8.4.post9+tuxcare"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.1"},{"fixed":"3.8.1.post16+tuxcare"}]}],"versions":["3.8.1","3.8.1.post1+tuxcare","3.8.1.post10+tuxcare","3.8.1.post11+tuxcare","3.8.1.post12+tuxcare","3.8.1.post13+tuxcare","3.8.1.post14+tuxcare","3.8.1.post15+tuxcare","3.8.1.post2+tuxcare","3.8.1.post3+tuxcare","3.8.1.post4+tuxcare","3.8.1.post5+tuxcare","3.8.1.post6+tuxcare","3.8.1.post7+tuxcare","3.8.1.post8+tuxcare","3.8.1.post9+tuxcare"],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1+deb12u2"}]}],"versions":["3.8.4-1","3.8.4-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.16-1","3.11.16-1+deb13u1","3.12.15-1","3.13.0-1","3.13.1-1","3.13.3-1","3.13.3-2","3.13.3-3","3.13.5-1","3.14.0-1","3.14.1-1","3.14.1-2","3.14.1-3","3.14.1-4","3.14.1-5","3.14.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-1"}]}],"versions":["3.11.16-1","3.12.15-1","3.13.0-1","3.13.1-1","3.13.3-1","3.13.3-2","3.13.3-3","3.13.5-1"]},{"source":"osv","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.2","0.20.0","0.20.1","0.20.2","0.21.0","0.21.1","0.21.2","0.21.4","0.21.5","0.21.6","0.22.0","0.22.0a0","0.22.0b0","0.22.0b1","0.22.0b2","0.22.0b3","0.22.0b4","0.22.0b5","0.22.0b6","0.22.1","0.22.2","0.22.3","0.22.4","0.22.5","0.3","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","2.0.0","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.0a1","2.3.0a2","2.3.0a3","2.3.0a4","2.3.1","2.3.10","2.3.1a1","2.3.2","2.3.2b2","2.3.2b3","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0b0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.0b1","3.10.0rc0","3.10.1","3.10.10","3.10.11","3.10.11rc0","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.6rc0","3.10.6rc1","3.10.6rc2","3.10.7","3.10.8","3.10.9","3.11.0","3.11.0b0","3.11.0b1","3.11.0b2","3.11.0b3","3.11.0b4","3.11.0b5","3.11.0rc0","3.11.0rc1","3.11.0rc2","3.11.1","3.11.10","3.11.11","3.11.12","3.11.13","3.11.14","3.11.15","3.11.16","3.11.17","3.11.18","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.11.8","3.11.9","3.12.0","3.12.0b0","3.12.0b1","3.12.0b2","3.12.0b3","3.12.0rc0","3.12.0rc1","3.12.1","3.12.10","3.12.11","3.12.12","3.12.13","3.12.14","3.12.15","3.12.1rc0","3.12.2","3.12.3","3.12.4","3.12.6","3.12.7","3.12.7rc0","3.12.8","3.12.9","3.13.0","3.13.1","3.13.2","3.13.3","3.13.4","3.13.5","3.2.0","3.2.1","3.3.0","3.3.0a0","3.3.1","3.3.2","3.3.2a0","3.4.0","3.4.0a0","3.4.0a3","3.4.0b1","3.4.0b2","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0a1","3.5.0b1","3.5.0b2","3.5.0b3","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0a0","3.6.0a1","3.6.0a11","3.6.0a12","3.6.0a2","3.6.0a3","3.6.0a4","3.6.0a5","3.6.0a6","3.6.0a7","3.6.0a8","3.6.0a9","3.6.0b0","3.6.1","3.6.1b3","3.6.1b4","3.6.2","3.6.2a0","3.6.2a1","3.6.2a2","3.6.3","3.7.0","3.7.0b0","3.7.0b1","3.7.1","3.7.2","3.7.3","3.7.4","3.7.4.post0","3.8.0","3.8.0a7","3.8.0b0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.9.0","3.9.0b0","3.9.0b1","3.9.0rc0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.4rc0","3.9.5"]},{"source":"osv","ecosystem":"Mageia:10","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.3-1.mga10"}]}],"bundled":17},{"source":"osv","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.2","0.20.0","0.20.1","0.20.2","0.21.0","0.21.1","0.21.2","0.21.4","0.21.5","0.21.6","0.22.0","0.22.0a0","0.22.0b0","0.22.0b1","0.22.0b2","0.22.0b3","0.22.0b4","0.22.0b5","0.22.0b6","0.22.1","0.22.2","0.22.3","0.22.4","0.22.5","0.3","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","2.0.0","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.0a1","2.3.0a2","2.3.0a3","2.3.0a4","2.3.1","2.3.10","2.3.1a1","2.3.2","2.3.2b2","2.3.2b3","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0b0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.0b1","3.10.0rc0","3.10.1","3.10.10","3.10.11","3.10.11rc0","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.6rc0","3.10.6rc1","3.10.6rc2","3.10.7","3.10.8","3.10.9","3.11.0","3.11.0b0","3.11.0b1","3.11.0b2","3.11.0b3","3.11.0b4","3.11.0b5","3.11.0rc0","3.11.0rc1","3.11.0rc2","3.11.1","3.11.10","3.11.11","3.11.12","3.11.13","3.11.14","3.11.15","3.11.16","3.11.17","3.11.18","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.11.8","3.11.9","3.12.0","3.12.0b0","3.12.0b1","3.12.0b2","3.12.0b3","3.12.0rc0","3.12.0rc1","3.12.1","3.12.10","3.12.11","3.12.12","3.12.13","3.12.14","3.12.15","3.12.1rc0","3.12.2","3.12.3","3.12.4","3.12.6","3.12.7","3.12.7rc0","3.12.8","3.12.9","3.13.0","3.13.1","3.13.2","3.13.3","3.13.4","3.13.5","3.2.0","3.2.1","3.3.0","3.3.0a0","3.3.1","3.3.2","3.3.2a0","3.4.0","3.4.0a0","3.4.0a3","3.4.0b1","3.4.0b2","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0a1","3.5.0b1","3.5.0b2","3.5.0b3","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0a0","3.6.0a1","3.6.0a11","3.6.0a12","3.6.0a2","3.6.0a3","3.6.0a4","3.6.0a5","3.6.0a6","3.6.0a7","3.6.0a8","3.6.0a9","3.6.0b0","3.6.1","3.6.1b3","3.6.1b4","3.6.2","3.6.2a0","3.6.2a1","3.6.2a2","3.6.3","3.7.0","3.7.0b0","3.7.0b1","3.7.1","3.7.2","3.7.3","3.7.4","3.7.4.post0","3.8.0","3.8.0a7","3.8.0b0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.9.0","3.9.0b0","3.9.0b1","3.9.0rc0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.4rc0","3.9.5"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-160000.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-160000.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.43.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.38.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.38.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.38.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.38.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.2-1","0.17.4-1","0.17.4-1build1","0.20.2-1","0.20.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.3-1build1","2.2.3-2","2.3.6-1","3.0.1-1","3.0.1-1ubuntu0.1~esm1","3.0.1-1ubuntu0.1~esm4","3.0.1-1ubuntu0.1~esm5","3.0.1-1ubuntu0.1~esm6","3.0.1-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.4-1","3.5.4-1build1","3.6.1-1","3.6.2-1","3.6.2-1build1","3.6.2-1ubuntu0.1~esm1","3.6.2-1ubuntu1","3.6.2-1ubuntu1+esm1","3.6.2-1ubuntu1+esm3","3.6.2-1ubuntu1+esm4","3.6.2-1ubuntu1+esm5","3.6.2-1ubuntu1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.4-1","3.7.4-1build2","3.8.1-3","3.8.1-4","3.8.1-4build1","3.8.1-4ubuntu0.2","3.8.1-4ubuntu0.2+esm1","3.8.1-4ubuntu0.2+esm2","3.8.1-4ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.4-1","3.9.1-1","3.9.1-1build1","3.9.1-1ubuntu0.1","3.9.1-1ubuntu0.1+esm1","3.9.1-1ubuntu0.1+esm2","3.9.1-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.11-1build1","3.11.16-1","3.11.16-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.3-3ubuntu1","3.14.1-4","3.14.1-5","3.14.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.16-1","3.13.1-1","3.13.3-3","3.13.3-3ubuntu1","3.13.3-3ubuntu1+esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.16-160000.6.1"}]}],"bundled":8}],"products":[{"vendor":"aio-libs","product":"aiohttp"},{"vendor":"aiohttp","product":"aiohttp"}],"references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/advisories/GHSA-m6qw-4cw2-hm4m"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50269","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50269.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-50269","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0584.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34938","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/05/14","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8032-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/P3YUGTP2FIH5YJ35RPLSZ7SRKNBOUQ4Z/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8591-1","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.13.4","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.13.5","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.14.0","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.14.1","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.14.2","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/releases#release-v3.14.3","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622819-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268398","tags":["report"]},{"url":"https://bugzilla.suse.com/1268543","tags":["report"]},{"url":"https://bugzilla.suse.com/1268544","tags":["report"]},{"url":"https://bugzilla.suse.com/1268549","tags":["report"]},{"url":"https://bugzilla.suse.com/1268556","tags":["report"]},{"url":"https://bugzilla.suse.com/1268559","tags":["report"]},{"url":"https://bugzilla.suse.com/1268560","tags":["report"]},{"url":"https://bugzilla.suse.com/1268561","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54280","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263207-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261320","tags":["report"]},{"url":"https://bugzilla.suse.com/1261321","tags":["report"]},{"url":"https://bugzilla.suse.com/1261322","tags":["report"]},{"url":"https://bugzilla.suse.com/1261329","tags":["report"]},{"url":"https://bugzilla.suse.com/1261331","tags":["report"]},{"url":"https://bugzilla.suse.com/1261332","tags":["report"]},{"url":"https://bugzilla.suse.com/1261334","tags":["report"]},{"url":"https://bugzilla.suse.com/1261335","tags":["report"]},{"url":"https://bugzilla.suse.com/1261343","tags":["report"]},{"url":"https://bugzilla.suse.com/1267471","tags":["report"]},{"url":"https://bugzilla.suse.com/1267561","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47265","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263208-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-50269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50269","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-50269","title":"AIOHTTP: CRLF injection in multipart headers","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.","status":"published","published":"2026-06-22T16:30:55.789Z","modified":"2026-06-22T17:22:34.049Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna"}],"cwes":["CWE-93","CWE-113"],"updated_at":"2026-11-02T14:20:09.098623Z"}],"euvd":[{"id":"EUVD-2026-38308","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.","status":"published","published":"2026-06-22T16:30:55Z","modified":"2026-06-22T17:22:34Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T18:20:34.238696Z"}],"ghsa":[{"id":"GHSA-m6qw-4cw2-hm4m","title":"aiohttp: CRLF injection in multipart headers","description":"### Summary\n\nAttacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.\n\n### Impact\n\nIn the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.\n\n### Workaround\n\nSanitise such user input.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8","status":"published","published":"2026-06-15T20:07:26Z","modified":"2026-06-15T20:07:27Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-93","CWE-113"],"updated_at":"2026-11-02T14:40:28.438722Z"}],"nvd":[{"id":"CVE-2026-50269","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.","status":"published","published":"2026-06-22T18:16:42.92Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-93","CWE-113"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-50269","title":"AIOHTTP: CRLF injection in multipart headers","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.","status":"published","published":"2026-06-22T16:30:55.789Z","modified":"2026-10-28T02:31:07.155285197Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-113","CWE-93"],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"DEBIAN-CVE-2026-50269","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.","status":"published","published":"2026-06-22T18:16:42.92Z","modified":"2026-11-01T00:00:12.608866398Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:56.877408Z"},{"id":"GHSA-m6qw-4cw2-hm4m","title":"aiohttp: CRLF injection in multipart headers","description":"### Summary\n\nAttacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.\n\n### Impact\n\nIn the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.\n\n### Workaround\n\nSanitise such user input.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8","status":"published","published":"2026-06-15T20:07:26Z","modified":"2026-09-10T03:51:09.078868018Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-113","CWE-93"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"PYSEC-2026-2106","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.","status":"published","published":"2026-06-22T18:16:42.92Z","modified":"2026-07-13T07:15:15.667130045Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-50269","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.","status":"published","published":"2026-06-22T18:16:00Z","modified":"2026-10-17T12:54:36.286404553Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"AZL-90656","title":"CVE-2026-50269 affecting package python-aiohttp 3.6.2-3","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.","status":"published","published":"2026-06-22T18:16:42Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1784769519","title":"TuxCare security update for aiohttp (6 CVEs)","description":"TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.6.post7+tuxcare.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:48:05.185984731Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1791372571","title":"TuxCare security update for aiohttp (5 CVEs)","description":"TuxCare rebuilt aiohttp to address 5 CVEs. Fixed in 3.8.5.post18+tuxcare.","status":"published","published":"2026-10-07T11:29:31Z","modified":"2026-10-15T09:46:21.705414075Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791373745","title":"TuxCare security update for aiohttp (5 CVEs)","description":"TuxCare rebuilt aiohttp to address 5 CVEs. Fixed in 3.8.4.post14+tuxcare.","status":"published","published":"2026-10-07T11:49:05Z","modified":"2026-10-15T09:48:07.255273066Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791377424","title":"TuxCare security update for aiohttp (7 CVEs)","description":"TuxCare rebuilt aiohttp to address 7 CVEs. Fixed in 3.8.1.post16+tuxcare.","status":"published","published":"2026-10-07T12:50:24Z","modified":"2026-10-15T09:48:07.227460191Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"MGASA-2026-0584","title":"Updated python-aiohttp package fixes security vulnerabilities","description":"Please see the links for additional information about the\nvulnerabilities and changes performed by developers since the version\n3.13.3.\n","status":"published","published":"2026-11-09T16:32:57Z","modified":"2026-11-09T16:58:28.023379647Z","updated_at":"2026-11-09T17:04:22.742827Z"},{"id":"openSUSE-SU-2026:11097-1","title":"python311-aiohttp-3.14.1-1.1 on GA media","description":"These are all security issues fixed in the python311-aiohttp-3.14.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-22T00:00:00Z","modified":"2026-06-24T09:00:22.412706781Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21372-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues\n\n- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers\n  (bsc#1268398).\n- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption\n  (bsc#1268543).\n- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive\n  resource consumption (bsc#1268544).\n- CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549).\n- CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource\n  consumption (bsc#1268556).\n- CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS\n  (bsc#1268559).\n- CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).\n- CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and\n  can cause resource starvation (bsc#1268561).\n","status":"published","published":"2026-07-18T09:46:55Z","modified":"2026-07-22T18:25:10.9181961Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22819-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues\n\n- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers\n  (bsc#1268398).\n- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption\n  (bsc#1268543).\n- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive\n  resource consumption (bsc#1268544).\n- CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549).\n- CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource\n  consumption (bsc#1268556).\n- CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS\n  (bsc#1268559).\n- CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).\n- CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and\n  can cause resource starvation (bsc#1268561).\n","status":"published","published":"2026-07-18T09:52:53Z","modified":"2026-07-28T18:24:07.816351947Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3207-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues\n\n- CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of\n  service (bsc#1261320).\n- CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321).\n- CVE-2026-34514: `content_type` parameter manipulation can lead to header injection (bsc#1261322).\n- CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of\n  service (bsc#1261329).\n- CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service\n  (bsc#1261331).\n- CVE-2026-34518: retained `Cookie` and `Proxy-Authorization` headers when following redirects can lead to information\n  disclosure (bsc#1261332).\n- CVE-2026-34519: response `reason` parameter can be use to perform header injection (bsc#1261334).\n- CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).\n- CVE-2026-34525: multiple `Host` headers allow for potential security bypass in proxy servers (bsc#1261343).\n- CVE-2026-34993: loading untrusted input in `CookieJar.load()` can lead to arbitrary code execution (bsc#1267471).\n- CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect\n  and can leak sensitive data (bsc#1267561).\n- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers\n  (bsc#1268398).\n- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption\n  (bsc#1268543).\n- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive\n  resource consumption (bsc#1268544).\n- CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549).\n- CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource\n  consumption (bsc#1268556).\n- CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS\n  (bsc#1268559).\n- CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).\n- CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and\n  can cause resource starvation (bsc#1268561).\n","status":"published","published":"2026-07-23T14:10:50Z","modified":"2026-07-24T17:16:06.381467415Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3208-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues:\n\n- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers\n  (bsc#1268398).\n- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption\n  (bsc#1268543).\n- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive\n  resource consumption (bsc#1268544).\n- CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549).\n- CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource\n  consumption (bsc#1268556).\n- CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS\n  (bsc#1268559).\n- CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).\n- CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and\n  can cause resource starvation (bsc#1268561).\n","status":"published","published":"2026-07-23T14:11:27Z","modified":"2026-07-24T17:16:06.420797803Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}