SUSE-SU-2026:3208-1
SUSE-SU-2026:3208-1 · Security update for python-aiohttp
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
This update for python-aiohttp fixes the following issues: - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398). - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543). - CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544). - CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549). - CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556). - CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS (bsc#1268559). - CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560). - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).
Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: system
Betroffene Produkte und Versionen
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP4
- Betroffene Versionsbereiche
- ECOSYSTEM: < 3.6.0-150100.3.38.1
Auf 3.6.0-150100.3.38.1 aktualisieren
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP5
- Betroffene Versionsbereiche
- ECOSYSTEM: < 3.6.0-150100.3.38.1
Auf 3.6.0-150100.3.38.1 aktualisieren
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP6
- Betroffene Versionsbereiche
- ECOSYSTEM: < 3.6.0-150100.3.38.1
Auf 3.6.0-150100.3.38.1 aktualisieren
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP7
- Betroffene Versionsbereiche
- ECOSYSTEM: < 3.6.0-150100.3.38.1
Auf 3.6.0-150100.3.38.1 aktualisieren
Originalquellen
- https://www.suse.com/support/update/announcement/2026/suse-su-20263208-1/
- https://bugzilla.suse.com/1268398
- https://bugzilla.suse.com/1268543
- https://bugzilla.suse.com/1268544
- https://bugzilla.suse.com/1268549
- https://bugzilla.suse.com/1268556
- https://bugzilla.suse.com/1268559
- https://bugzilla.suse.com/1268560
- https://bugzilla.suse.com/1268561
- https://www.suse.com/security/cve/CVE-2026-50269
- https://www.suse.com/security/cve/CVE-2026-54273
- https://www.suse.com/security/cve/CVE-2026-54274
- https://www.suse.com/security/cve/CVE-2026-54275
- https://www.suse.com/security/cve/CVE-2026-54277
- https://www.suse.com/security/cve/CVE-2026-54278
- https://www.suse.com/security/cve/CVE-2026-54279
- https://www.suse.com/security/cve/CVE-2026-54280
- https://osv.dev/vulnerability/SUSE-SU-2026:3208-1