https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 06:23:50 +0000 https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-50269 <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary</p> <p>Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.</p> <p>### Impact</p> <p>In the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.</p> <p>### Workaround</p> <p>Sanitise such user input.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8</p> <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary</p> <p>Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.</p> <p>### Impact</p> <p>In the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.</p> <p>### Workaround</p> <p>Sanitise such user input.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8</p> https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-50269 https://cve.radiocsirt.org/vuln/cleanstart-2026-mi51590 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kserve-storage-controller</p> <p>Package kserve-storage-controller version 0.19.0-r0 fixes 91 vulnerabilities: CVE-2024-12254, CVE-2024-12718, CVE-2024-6232, CVE-2024-7592, CVE-2024-9287...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kserve-storage-controller</p> <p>Package kserve-storage-controller version 0.19.0-r0 fixes 91 vulnerabilities: CVE-2024-12254, CVE-2024-12718, CVE-2024-6232, CVE-2024-7592, CVE-2024-9287...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-mi51590 https://cve.radiocsirt.org/vuln/euvd-2026-329039 EUVD-2026-329039 https://cve.radiocsirt.org/vuln/euvd-2026-329039 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50269 <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50269 https://cve.radiocsirt.org/vuln/ghsa-m6qw-4cw2-hm4m <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.</p> <p>### Impact</p> <p>In the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.</p> <p>### Workaround</p> <p>Sanitise such user input.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.</p> <p>### Impact</p> <p>In the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.</p> <p>### Workaround</p> <p>Sanitise such user input.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8</p> https://cve.radiocsirt.org/vuln/ghsa-m6qw-4cw2-hm4m https://cve.radiocsirt.org/vuln/opensuse-su-2026:11097-1 <p>python311-aiohttp-3.14.1-1.1 on GA media</p> <p>python311-aiohttp-3.14.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11097-1 https://cve.radiocsirt.org/vuln/pysec-2026-2106 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2106 https://cve.radiocsirt.org/vuln/suse-su-2026:22819-1 <p>Security update for python-aiohttp</p> <p>Security update for python-aiohttp</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22819-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50269 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp, Ubuntu:Pro:26.04:LTS: python-aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:20.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp, Ubuntu:Pro:26.04:LTS: python-aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50269