0x20bf (0.0.1), 2keys (0.5.1) +3456 more potentially affected by CVE-2026-54280 via aiohttp (>=3.0.0b0, <=3.14.0)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =3.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 and more Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

0x20bf (0.0.1), 2keys (0.5.1) +3456 more potentially affected by CVE-2026-54280 via aiohttp (>=3.0.0b0, <=3.14.0)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =3.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 and more Source cves: CVE-2026-54280 Source advisory: GHSA-9X8Q-7H8H-WCW9...

muffin (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-54280 via aiohttp (0.17.3)

aiohttp PYPI version 0.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.5, =0.1.6 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

devtools-proxy (>=0.0.2, <=0.0.3) potentially affected by CVE-2026-54280 via aiohttp (1.1.4)

aiohttp PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - devtools-proxy =0.0.2, =0.0.3 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2026-54280 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

aiobotocore (>=0.4.0, <=0.4.1), async-patterns (0.2.0) +7 more potentially affected by CVE-2026-54280 via aiohttp (2.2.0)

aiohttp PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiobotocore =0.4.0, =0.1.1, =0.2.2, =0.48.0, =0.4.1b2, =0.5.2b0, =0.1.0a88, =0.1.0b10 Source cves: CVE-2026-54280 Source advisory:...

muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2026-54280 via aiohttp (0.14.1)

aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

scriptworker (0.2.1) potentially affected by CVE-2026-54280 via aiohttp (0.22.0a0)

aiohttp PYPI version 0.22.0a0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - scriptworker 0.2.1 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

pushpull (0.0.2) potentially affected by CVE-2026-54280 via aiohttp (0.22.0)

aiohttp PYPI version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pushpull 0.0.2 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2026-54280 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2026-54280 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

muffin (>=0.0.46, <=0.0.52) potentially affected by CVE-2026-54280 via aiohttp (0.15.0)

aiohttp PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.46, =0.0.52 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

echod (0.1.0), muffin (>=0.0.94, <=0.0.97) potentially affected by CVE-2026-54280 via aiohttp (0.16.5)

aiohttp PYPI version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - echod 0.1.0 - muffin =0.0.94, =0.0.97 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

muffin (0.5.0) potentially affected by CVE-2026-54280 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

aiobotocore (0.2.3), aiobotocore-botorange (>=0.1.0, <=0.2.3a0) +9 more potentially affected by CVE-2026-54280 via aiohttp (1.3.5)

aiohttp PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiobotocore 0.2.3 - aiobotocore-botorange =0.1.0, =0.0.3a0, =1.2.0, =1.0.0, =3.0.2, =3.0.5 Source cves: CVE-2026-54280 Source advisory:...

homeassistant (>=0.42.0, <=0.42.3) potentially affected by CVE-2026-54280 via aiohttp (2.0.5)

aiohttp PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.42.0, =0.42.3 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

homeassistant (0.42.1) potentially affected by CVE-2026-54280 via aiohttp (2.0.6)

aiohttp PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant 0.42.1 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2026-54280 via aiohttp (1.1.6)

aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

Summary Payload resources are not closed correctly when a client disconnects in the middle of a write. Impact If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file...

Improper Resource Shutdown or Release

Overview Affected versions of this package are vulnerable to Improper Resource Shutdown or Release in the payload response resources when a client disconnects during a write operation. An attacker can cause temporary resource exhaustion by repeatedly initiating connections and disconnecting...