SUSE-SU-2026:3207-1

SUSE-SU-2026:3207-1 · Security update for python-aiohttp

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.

This update for python-aiohttp fixes the following issues - CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service (bsc#1261320). - CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321). - CVE-2026-34514: `content_type` parameter manipulation can lead to header injection (bsc#1261322). - CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of service (bsc#1261329). - CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service (bsc#1261331). - CVE-2026-34518: retained `Cookie` and `Proxy-Authorization` headers when following redirects can lead to information disclosure (bsc#1261332). - CVE-2026-34519: response `reason` parameter can be use to perform header injection (bsc#1261334). - CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335). - CVE-2026-34525: multiple `Host` headers allow for potential security bypass in proxy servers (bsc#1261343). - CVE-2026-34993: loading untrusted input in `CookieJar.load()` can lead to arbitrary code execution (bsc#1267471). - CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect and can leak sensitive data (bsc#1267561). - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398). - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543). - CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544). - CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549). - CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556). - CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS (bsc#1268559). - CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560). - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).

Corrección disponible

Publicación

2026-07-23T14:10:50Z

Actualización

2026-07-24T17:16:06.381467415Z

Pila tecnológica: system

Comprueba tu servidor →