muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2026-34514 via aiohttp (0.14.1)

aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2026-34514 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

muffin (>=0.7.1, <=0.8.6) potentially affected by CVE-2026-34514 via aiohttp (0.21.6)

aiohttp PYPI version 0.21.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.7.1, =0.8.6 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

aio-tinder (>=0.1.1, <=0.1.3), muffin (0.9.0) +3 more potentially affected by CVE-2026-34514 via aiohttp (0.22.5)

aiohttp PYPI version 0.22.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.1, =0.0.3, =0.1.0, =0.4.0 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

s2aio (>=1.12.0, <=1.14.0) potentially affected by CVE-2026-34514 via aiohttp (0.22.4)

aiohttp PYPI version 0.22.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - s2aio =1.12.0, =1.14.0 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

muffin (0.7.0), solo (0.0.1) potentially affected by CVE-2026-34514 via aiohttp (0.21.5)

aiohttp PYPI version 0.21.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.7.0 - solo 0.0.1 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

muffin (>=0.0.46, <=0.0.52) potentially affected by CVE-2026-34514 via aiohttp (0.15.0)

aiohttp PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.46, =0.0.52 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-34514 via aiohttp (2.3.0a4)

aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-34514 Source advisory: OSV:PYSEC-2026-2096...

PYSEC-2026-2095

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4...

aiopixiv (1.0.5) potentially affected by CVE-2026-34517 via aiohttp (2.0.4)

aiohttp PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv 1.0.5 Source cves: CVE-2026-34517 Source advisory: OSV:PYSEC-2026-2099...

0x20bf (0.0.1), 2keys (0.5.1) +3262 more potentially affected by CVE-2026-34513 via aiohttp (>=3.0.0b0, <=3.13.3)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 - ab-data-processing 0.0.1 and more Source cves: CVE-2026-34513 Source advisory: OSV:PYSEC-2026-2095...

muffin (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-34517 via aiohttp (0.17.3)

aiohttp PYPI version 0.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.5, =0.1.6 Source cves: CVE-2026-34517 Source advisory: OSV:PYSEC-2026-2099...

DEBIAN-CVE-2026-34513

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4...

muffin (>=0.3.0, <=0.3.2) potentially affected by CVE-2026-34517 via aiohttp (0.18.3)

aiohttp PYPI version 0.18.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.0, =0.3.2 Source cves: CVE-2026-34517 Source advisory: OSV:PYSEC-2026-2099...

homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2026-34517 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2026-34517 Source advisory: OSV:PYSEC-2026-2099...

DEBIAN-CVE-2026-34517

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking clientmaxsize. This issue has been patched in version 3.13.4...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2026-34515 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2026-34515 Source advisory: OSV:PYSEC-2026-2097...

pyplanet (0.5.3) potentially affected by CVE-2026-34515 via aiohttp (2.3.3)

aiohttp PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyplanet 0.5.3 Source cves: CVE-2026-34515 Source advisory: OSV:PYSEC-2026-2097...

goblin (1.0.0b1) potentially affected by CVE-2026-34515 via aiohttp (0.22.1)

aiohttp PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - goblin 1.0.0b1 Source cves: CVE-2026-34515 Source advisory: OSV:PYSEC-2026-2097...

aiohttp-cors (0.3.0), aslack (0.11.0) +1 more potentially affected by CVE-2026-34515 via aiohttp (0.20.2)

aiohttp PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiohttp-cors 0.3.0 - aslack 0.11.0 - muffin =0.5.2, =0.5.12 Source cves: CVE-2026-34515 Source advisory: OSV:PYSEC-2026-2097...