OESA-2026-3583 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attack...

OESA-2026-3582 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attack...

OESA-2026-3581 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attack...

PT-2026-89178

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.11.0 Description An authenticated user can perform a Server-Side Request Forgery SSRF attack when the AIOHTTP CLIENT ALLOW REDIRECTS variable is set to true. The platform fails to reapply the WEB FETCH FILTE...

CLSA-2026-1787915974 TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.6.post11+tuxcare...

CLSA-2026-1787906503 TuxCare security update for aiohttp (7 CVEs)

TuxCare rebuilt aiohttp to address 7 CVEs. Fixed in 3.8.6.post10+tuxcare...

CLSA-2026-1787905713 TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.4.post7+tuxcare...

PT-2026-83124

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.17.1 Description Remote attackers can cause a Denial of Service through memory exhaustion. The AsyncMediaIO.fetch audio and AsyncMediaIO.fetch image functions in multimodal/inputs.py use aiohttp to fetch user-supplied...

CVE-2026-37237

The vLLM library (up to and including version 0.17.0 ) is vulnerable to a Denial of Service (DoS) via memory exhaustion. The root cause lies in the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions within multimodal/inputs.py. These functions utilize the aiohttp library to fetch use...

CLSA-2026-1787723258 TuxCare security update for aiohttp (3 CVEs)

TuxCare rebuilt aiohttp to address 3 CVEs. Fixed in 3.8.5.post10+tuxcare...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...

Fedora 45 : python-aiohttp (2026-e76e1f737b)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e76e1f737b advisory. Automatic update for python-aiohttp-3.14.3-3.fc45. Changelog Mon Aug 24 2026 Benjamin A. Beasley - 3.14.3-3 - Preemptively patch for Cython 3.3...

Fedora 46 : python-aiohttp (2026-84f7af8f97)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-84f7af8f97 advisory. Automatic update for python-aiohttp-3.14.3-3.fc46. Changelog Mon Aug 24 2026 Benjamin A. Beasley - 3.14.3-3 - Preemptively patch for Cython 3.3...

CLSA-2026-1787296163 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.4.post6+tuxcare...

EUVD-2026-63732

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...