SUSE-SU-2026:3207-1

SUSE-SU-2026:3207-1 · Security update for python-aiohttp

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Diese Seite zeigt ausgewählte Angaben aus den Quellen. Die vollständige Beschreibung und betroffene Versionen finden Sie in den verlinkten Sicherheitshinweisen.

This update for python-aiohttp fixes the following issues - CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service (bsc#1261320). - CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321). - CVE-2026-34514: `content_type` parameter manipulation can lead to header injection (bsc#1261322). - CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of service (bsc#1261329). - CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service (bsc#1261331). - CVE-2026-34518: retained `Cookie` and `Proxy-Authorization` headers when following redirects can lead to information disclosure (bsc#1261332). - CVE-2026-34519: response `reason` parameter can be use to perform header injection (bsc#1261334). - CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335). - CVE-2026-34525: multiple `Host` headers allow for potential security bypass in proxy servers (bsc#1261343). - CVE-2026-34993: loading untrusted input in `CookieJar.load()` can lead to arbitrary code execution (bsc#1267471). - CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect and can leak sensitive data (bsc#1267561). - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398). - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543). - CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544). - CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549). - CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556). - CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS (bsc#1268559). - CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560). - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).

Korrektur verfügbar

Veröffentlicht

2026-07-23T14:10:50Z

Aktualisiert

2026-07-24T17:16:06.381467415Z

Technologie-Stack: system

Prüfen Sie Ihren Server →