This update for python-aiohttp fixes the following issues:
- CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated
permessage-deflate (bsc#1273125).
- CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
- CVE-2026-69244: out-of-bounds heap read in the C response parser while building an error message for a malformed
response (bsc#1273552).
This update for python-aiohttp fixes the following issues
- CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of
service (bsc#1261320).
- CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321).
- CVE-2026-34514: `content_type` parameter manipulation can lead to header injection (bsc#1261322).
- CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of
service (bsc#1261329).
- CVE-2026-34517: large multipart form fields read into memory without size check can
This update for python-aiohttp fixes the following issues:
- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#1256019).
- CVE-2025-69229: Fixed DoS throu
This update for python-aiohttp fixes the following issues:
- CVE-2025-53643: Fixed request smuggling due to incorrect parsing of chunked trailer section (bsc#1246517)