https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:42:33.032955+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09579 bdu:2026-09579 2026-10-03T10:42:33.765627+00:00 bdu:2026-09579 https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-34525 BREW-aider-CVE-2026-34525 — AIOHTTP accepts duplicate Host headers 2026-10-03T10:42:33.765678+00:00

Affected: Homebrew: aider

### Summary

Multiple Host headers were allowed in aiohttp.

### Impact

Mostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using `Application.add_domain()`.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349 Patch: https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0550 certfr-2026-avi-0550 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T10:42:33.765740+00:00 certfr-2026-avi-0550 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 Withdrawn: CLEANSTART-2026-AN24336 — Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-… 2026-10-03T10:42:33.765766+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-329293 EUVD-2026-329293 2026-10-03T10:42:33.765820+00:00 EUVD-2026-329293 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34525 fkie_cve-2026-34525 2026-10-03T10:42:33.765841+00:00

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.

 https://cve.radiocsirt.org/vuln/ghsa-c427-h43c-vf67 GHSA-c427-h43c-vf67 — AIOHTTP accepts duplicate Host headers 2026-10-03T10:42:33.765872+00:00

Affected: PyPI: aiohttp

### Summary

Multiple Host headers were allowed in aiohttp.

### Impact

Mostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using `Application.add_domain()`.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349 Patch: https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000

 https://cve.radiocsirt.org/vuln/oesa-2026-2192 OESA-2026-2192 — python-aiohttp security update 2026-10-03T10:42:33.765913+00:00

Affected: openEuler:24.03-LTS-SP1: python-aiohttp

Async http client/server framework (asyncio). Security Fix(es):

Insufficient restrictions in header/trailer handling could cause uncapped memory usage.(CVE-2026-22815)

An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.(CVE-2026-34513)

An attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits.(CVE-2026-34514)

A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.(CVE-2026-34516)

For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.(CVE-2026-34517)

When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.(CVE-2026-34518)

aiohttp is vulnerable to HTTP response splitting attacks. An attacker can insert carriage return (\r) characters in the reason phrase to craft malicious responses, leading to response splitting attacks. This vulnerability affects aiohttp versions up to and including 3.13.3.(CVE-2026-34519)

The llhttp parser in aiohttp accepts null bytes and control characters in response header values, which could allow attackers to perform HTTP header injection attacks and bypass security restrictions.(CVE-2026-34520)

aiohttp is a Python asynchronous HTTP client/server framework. In version 3.13.3 and earlier, there is a sec…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21098-1 openSUSE-SU-2026:21098-1 — Security update for python-aiohttp 2026-10-03T10:42:33.765976+00:00

Security update for python-aiohttp

 https://cve.radiocsirt.org/vuln/pysec-2026-2103 PYSEC-2026-2103 2026-10-03T10:42:33.766010+00:00

Affected: PyPI: aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22173-1 SUSE-SU-2026:22173-1 — Security update for python-aiohttp 2026-10-03T10:42:33.766038+00:00

Security update for python-aiohttp

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34525 UBUNTU-CVE-2026-34525 2026-10-03T10:42:33.766069+00:00

Affected: Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp, Ubuntu:Pro:26.04:LTS: python-aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933 WID-SEC-W-2026-2933 — Splunk SOAR: Mehrere Schwachstellen 2026-10-03T10:42:33.766113+00:00

Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.