https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:53:48 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07337 bdu:2026-07337 https://cve.radiocsirt.org/vuln/bdu:2026-07337 https://cve.radiocsirt.org/vuln/brew-aider-cve-2025-69223 <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary A zip bomb can be used to execute a DoS against the aiohttp server.</p> <p>### Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host&#39;s memory.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a</p> <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary A zip bomb can be used to execute a DoS against the aiohttp server.</p> <p>### Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host&#39;s memory.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a</p> https://cve.radiocsirt.org/vuln/brew-aider-cve-2025-69223 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0224 certfr-2026-avi-0224 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0224 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 https://cve.radiocsirt.org/vuln/euvd-2026-371787 EUVD-2026-371787 https://cve.radiocsirt.org/vuln/euvd-2026-371787 https://cve.radiocsirt.org/vuln/fkie_cve-2025-69223 <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host&#39;s memory. This issue is fixed in version 3.13.3.</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host&#39;s memory. This issue is fixed in version 3.13.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-69223 https://cve.radiocsirt.org/vuln/ghsa-6mq8-rvhq-8wgg <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary A zip bomb can be used to execute a DoS against the aiohttp server.</p> <p>### Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host&#39;s memory.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary A zip bomb can be used to execute a DoS against the aiohttp server.</p> <p>### Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host&#39;s memory.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a</p> https://cve.radiocsirt.org/vuln/ghsa-6mq8-rvhq-8wgg https://cve.radiocsirt.org/vuln/opensuse-su-2026:10025-1 <p>python311-aiohttp-3.13.3-1.1 on GA media</p> <p>python311-aiohttp-3.13.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10025-1 https://cve.radiocsirt.org/vuln/pysec-2026-1101 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary A zip bomb can be used to execute a DoS against the aiohttp server.</p> <p>### Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host&#39;s memory.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary A zip bomb can be used to execute a DoS against the aiohttp server.</p> <p>### Impact An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host&#39;s memory.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a</p> https://cve.radiocsirt.org/vuln/pysec-2026-1101 https://cve.radiocsirt.org/vuln/rhsa-2026:10184 <p>vllm: Server Side request forgery (SSRF) in MediaConnector feast: Feast: Remote Code Execution via insecure YAML deserialization openshift-ai: Trusty AI Grants All Authenticated users to list pods in any namespace nltk: Zip Slip Vulnerability in nltk Leading to Code Execution golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse aiohttp: AIOHTTP&#39;s HTTP Parser auto_decompress feature is vulnerable to zip bomb aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request python-markdown: denial of service via malformed HTML-like sequences nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function nltk: NLTK: Arbitrary file read via path traversal vulnerability io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files google-cloud-aiplatform: google-cloud-aiplatform: Arbitrary code execution via Stored Cross-Site Scripting (XSS) tensorflow: TensorFlow: Local privilege escalation via…</p> <p>vllm: Server Side request forgery (SSRF) in MediaConnector feast: Feast: Remote Code Execution via insecure YAML deserialization openshift-ai: Trusty AI Grants All Authenticated users to list pods in any namespace nltk: Zip Slip Vulnerability in nltk Leading to Code Execution golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse aiohttp: AIOHTTP&#39;s HTTP Parser auto_decompress feature is vulnerable to zip bomb aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request python-markdown: denial of service via malformed HTML-like sequences nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function nltk: NLTK: Arbitrary file read via path traversal vulnerability io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files google-cloud-aiplatform: google-cloud-aiplatform: Arbitrary code execution via Stored Cross-Site Scripting (XSS) tensorflow: TensorFlow: Local privilege escalation via…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:10184 https://cve.radiocsirt.org/vuln/suse-su-2026:20425-1 <p>Security update for python-aiohttp, python-Brotli</p> <p>Security update for python-aiohttp, python-Brotli</p> https://cve.radiocsirt.org/vuln/suse-su-2026:20425-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-69223 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host&#39;s memory. This issue is fixed in version 3.13.3.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host&#39;s memory. This issue is fixed in version 3.13.3.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-69223 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0935 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0935