https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:15:04.751674+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-11139 bdu:2026-11139 2026-10-02T16:15:06.456963+00:00 bdu:2026-11139 https://cve.radiocsirt.org/vuln/brew-advai-cli-cve-2026-69243 BREW-advai-cli-CVE-2026-69243 — AIOHTTP: HTTP request smuggling via WebSocket upgrade 2026-10-02T16:15:06.457037+00:00

Affected: Homebrew: advai-cli

### Summary

The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.

### Impact

If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.

---

Patch: https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98

 https://cve.radiocsirt.org/vuln/cleanstart-2026-ex36838 Withdrawn: CLEANSTART-2026-EX36838 — Security fixes in airflow-3 3.3.0-r2 2026-10-02T16:15:06.457079+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-3

Package airflow-3 version 3.3.0-r2 fixes 7 vulnerabilities: CVE-2026-69244, CVE-2026-59881, CVE-2026-69243, CVE-2026-69247, CVE-2026-69249...

 https://cve.radiocsirt.org/vuln/euvd-2026-348619 EUVD-2026-348619 2026-10-02T16:15:06.457104+00:00 EUVD-2026-348619 https://cve.radiocsirt.org/vuln/fkie_cve-2026-69243 fkie_cve-2026-69243 2026-10-02T16:15:06.457117+00:00

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

 https://cve.radiocsirt.org/vuln/ghsa-mfx4-hv73-q22v GHSA-mfx4-hv73-q22v — AIOHTTP: HTTP request smuggling via WebSocket upgrade 2026-10-02T16:15:06.457141+00:00

Affected: PyPI: aiohttp

### Summary

The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.

### Impact

If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.

---

Patch: https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98

 https://cve.radiocsirt.org/vuln/oesa-2026-3581 OESA-2026-3581 — python-aiohttp security update 2026-10-02T16:15:06.457165+00:00

Affected: openEuler:24.03-LTS-SP3: python-aiohttp

Async http client/server framework (asyncio). Security Fix(es):

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.(CVE-2026-69243)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11467-1 openSUSE-SU-2026:11467-1 — python313-aiohttp-3.14.3-1.1 on GA media 2026-10-02T16:15:06.457188+00:00

python313-aiohttp-3.14.3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-3546 PYSEC-2026-3546 — AIOHTTP: HTTP request smuggling via WebSocket upgrade 2026-10-02T16:15:06.457223+00:00

Affected: PyPI: aiohttp

### Summary

The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.

### Impact

If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.

---

Patch: https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98

 https://cve.radiocsirt.org/vuln/rhsa-2026:54760 RHSA-2026:54760 — Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage 2026-10-02T16:15:06.457272+00:00

cpython: python: Extraction filter bypass for linking outside extraction directory postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation postcss: PostCSS: Information disclosure via crafted sourceMappingURL aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses nanoid: nanoid: Predictable ID generation due to integer overflow browserslist: Browserslist: Prototype pollution leading to denial o…

 https://cve.radiocsirt.org/vuln/suse-su-2026:23571-1 SUSE-SU-2026:23571-1 — Security update for python-aiohttp 2026-10-02T16:15:06.457380+00:00

Security update for python-aiohttp

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-69243 UBUNTU-CVE-2026-69243 2026-10-02T16:15:06.457409+00:00

Affected: Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:Pro:26.04:LTS: python-aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.