SUSE-SU-2026:3207-1

Advisory lineage Upstream: 19 Downstream: 0
Published: 23 Jul 2026, 14:10
Last modified:24 Jul 2026, 17:16

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

23 Jul 2026, 14:10
Published
Vulnerability first disclosed
24 Jul 2026, 17:16
Last Modified
Vulnerability information updated

Description

Security update for python-aiohttp This update for python-aiohttp fixes the following issues - CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service (bsc#1261320). - CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321). - CVE-2026-34514: `content_type` parameter manipulation can lead to header injection (bsc#1261322). - CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of service (bsc#1261329). - CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service (bsc#1261331). - CVE-2026-34518: retained `Cookie` and `Proxy-Authorization` headers when following redirects can lead to information disclosure (bsc#1261332). - CVE-2026-34519: response `reason` parameter can be use to perform header injection (bsc#1261334). - CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335). - CVE-2026-34525: multiple `Host` headers allow for potential security bypass in proxy servers (bsc#1261343). - CVE-2026-34993: loading untrusted input in `CookieJar.load()` can lead to arbitrary code execution (bsc#1267471). - CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect and can leak sensitive data (bsc#1267561). - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398). - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543). - CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544). - CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549). - CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556). - CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS (bsc#1268559). - CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560). - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).

Affected Systems

  • suse•python-aiohttp&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

    < 3.9.3-150400.10.43.1

  • suse•python-aiohttp&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

    < 3.9.3-150400.10.43.1

  • suse•python-aiohttp&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

    < 3.9.3-150400.10.43.1

  • suse•python-aiohttp&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

    < 3.9.3-150400.10.43.1

  • suse•python-aiohttp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4

    < 3.9.3-150400.10.43.1

  • suse•python-aiohttp&distro=SUSE Linux Enterprise Module for Python 3 15 SP7

    < 3.9.3-150400.10.43.1

  • suse•python-aiohttp&distro=SUSE Linux Enterprise Server 15 SP4-LTSS

    < 3.9.3-150400.10.43.1

  • suse•python-aiohttp&distro=SUSE Linux Enterprise Server 15 SP5-LTSS

    < 3.9.3-150400.10.43.1

  • suse•python-aiohttp&distro=SUSE Linux Enterprise Server 15 SP6-LTSS

    < 3.9.3-150400.10.43.1

  • suse•python-aiohttp&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4

    < 3.9.3-150400.10.43.1

  • suse•python-aiohttp&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5

    < 3.9.3-150400.10.43.1

  • suse•python-aiohttp&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6

    < 3.9.3-150400.10.43.1

References (39)