https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:32:37 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09577 bdu:2026-09577 https://cve.radiocsirt.org/vuln/bdu:2026-09577 https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-34519 <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary</p> <p>An attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.</p> <p>### Impact</p> <p>In the unlikely situation that an application allows untrusted data to be used in the response&#39;s `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b</p> <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary</p> <p>An attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.</p> <p>### Impact</p> <p>In the unlikely situation that an application allows untrusted data to be used in the response&#39;s `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b</p> https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-34519 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0550 certfr-2026-avi-0550 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0550 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 https://cve.radiocsirt.org/vuln/euvd-2026-278796 EUVD-2026-278796 https://cve.radiocsirt.org/vuln/euvd-2026-278796 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34519 <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34519 https://cve.radiocsirt.org/vuln/ghsa-mwh4-6h8g-pg8w <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>An attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.</p> <p>### Impact</p> <p>In the unlikely situation that an application allows untrusted data to be used in the response&#39;s `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>An attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.</p> <p>### Impact</p> <p>In the unlikely situation that an application allows untrusted data to be used in the response&#39;s `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b</p> https://cve.radiocsirt.org/vuln/ghsa-mwh4-6h8g-pg8w https://cve.radiocsirt.org/vuln/oesa-2026-2192 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python-aiohttp</p> <p>Async http client/server framework (asyncio). Security Fix(es):</p> <p>Insufficient restrictions in header/trailer handling could cause uncapped memory usage.(CVE-2026-22815)</p> <p>An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.(CVE-2026-34513)</p> <p>An attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits.(CVE-2026-34514)</p> <p>A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.(CVE-2026-34516)</p> <p>For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.(CVE-2026-34517)</p> <p>When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.(CVE-2026-34518)</p> <p>aiohttp is vulnerable to HTTP response splitting attacks. An attacker can insert carriage return (\r) characters in the reason phrase to craft malicious responses, leading to response splitting attacks. This vulnerability affects aiohttp versions up to and including 3.13.3.(CVE-2026-34519)</p> <p>The llhttp parser in aiohttp accepts null bytes and control characters in response header values, which could allow attackers to perform HTTP header injection attacks and bypass security restrictions.(CVE-2026-34520)</p> <p>aiohttp is a Python asynchronous HTTP client/server framework. In version 3.13.3 and earlier, there is a sec…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python-aiohttp</p> <p>Async http client/server framework (asyncio). Security Fix(es):</p> <p>Insufficient restrictions in header/trailer handling could cause uncapped memory usage.(CVE-2026-22815)</p> <p>An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.(CVE-2026-34513)</p> <p>An attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits.(CVE-2026-34514)</p> <p>A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.(CVE-2026-34516)</p> <p>For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.(CVE-2026-34517)</p> <p>When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.(CVE-2026-34518)</p> <p>aiohttp is vulnerable to HTTP response splitting attacks. An attacker can insert carriage return (\r) characters in the reason phrase to craft malicious responses, leading to response splitting attacks. This vulnerability affects aiohttp versions up to and including 3.13.3.(CVE-2026-34519)</p> <p>The llhttp parser in aiohttp accepts null bytes and control characters in response header values, which could allow attackers to perform HTTP header injection attacks and bypass security restrictions.(CVE-2026-34520)</p> <p>aiohttp is a Python asynchronous HTTP client/server framework. In version 3.13.3 and earlier, there is a sec…</p> https://cve.radiocsirt.org/vuln/oesa-2026-2192 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21098-1 <p>Security update for python-aiohttp</p> <p>Security update for python-aiohttp</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21098-1 https://cve.radiocsirt.org/vuln/pysec-2026-2101 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2101 https://cve.radiocsirt.org/vuln/suse-su-2026:22173-1 <p>Security update for python-aiohttp</p> <p>Security update for python-aiohttp</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22173-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34519 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp, Ubuntu:Pro:26.04:LTS: python-aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp, Ubuntu:Pro:26.04:LTS: python-aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34519 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933 <p>Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933