s2aio (>=1.12.0, <=1.14.0) potentially affected by CVE-2026-50269 via aiohttp (0.22.4)

aiohttp PYPI version 0.22.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - s2aio =1.12.0, =1.14.0 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-50269 via aiohttp (2.3.0a4)

aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

GHSA-M6QW-4CW2-HM4M aiohttp: CRLF injection in multipart headers

Summary Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. Impact In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.appendheaders=... or Payload.headers, the...

aiobotocore (0.2.3), aiobotocore-botorange (>=0.1.0, <=0.2.3a0) +9 more potentially affected by CVE-2026-50269 via aiohttp (1.3.5)

aiohttp PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiobotocore 0.2.3 - aiobotocore-botorange =0.1.0, =0.0.3a0, =1.2.0, =1.0.0, =3.0.2, =3.0.5 Source cves: CVE-2026-50269 Source advisory:...

0x20bf (0.0.1), 2keys (0.5.1) +3450 more potentially affected by CVE-2026-50269 via aiohttp (>=3.0.0b0, <=3.13.5)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =3.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 and more Source cves: CVE-2026-50269 Source advisory: GHSA-M6QW-4CW2-HM4M...

iamine (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-50269 via aiohttp (0.13.1)

aiohttp PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - iamine =0.1.5, =0.1.6 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

aiohttp: CRLF injection in multipart headers

Summary Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. Impact In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.appendheaders=... or Payload.headers, the...

muffin (0.5.1) potentially affected by CVE-2026-50269 via aiohttp (0.20.1)

aiohttp PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.1 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

0x20bf (0.0.1), 2keys (0.5.1) +3450 more potentially affected by CVE-2026-50269 via aiohttp (>=3.0.0b0, <=3.13.5)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =3.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 and more Source cves: CVE-2026-50269 Source advisory: SNYK:PYTHON-AIOHTTP-17342380...

aioHTTP < 3.14.0 Multiple Vulnerabilities

The version of aioHTTP installed on the remote host is prior to 3.14.0. It is, therefore, affected by multiple vulnerabilities: - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load with untrusted input may allow arbitrary...

CVE-2026-34993

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

OESA-2026-2563 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.CVE-2026-34993 If a developer uses the cookies parameter on a per-request basis then sensitive data might be...

OPENSUSE-SU-2026:10963-1 python311-aiohttp-3.14.0-1.1 on GA media

These are all security issues fixed in the python311-aiohttp-3.14.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-47265

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might ...

CVE-2026-47265

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. This vulnerability allows a remote attacker to potentially gain access to sensitive information. When a developer uses the cookies parameter on a per-request basis, cookies are sent after following a...

muffin (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-47265 via aiohttp (0.17.3)

aiohttp PYPI version 0.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.5, =0.1.6 Source cves: CVE-2026-47265 Source advisory: OSV:GHSA-HG6J-4RV6-33PG...

EUVD-2026-34007

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies...

goblin (1.0.0b1) potentially affected by CVE-2026-47265 via aiohttp (0.22.1)

aiohttp PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - goblin 1.0.0b1 Source cves: CVE-2026-47265 Source advisory: OSV:GHSA-HG6J-4RV6-33PG...

muffin (0.7.0), solo (0.0.1) potentially affected by CVE-2026-47265 via aiohttp (0.21.5)

aiohttp PYPI version 0.21.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.7.0 - solo 0.0.1 Source cves: CVE-2026-47265 Source advisory: OSV:GHSA-HG6J-4RV6-33PG...

homeassistant (>=0.42.0, <=0.42.3) potentially affected by CVE-2026-47265 via aiohttp (2.0.5)

aiohttp PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.42.0, =0.42.3 Source cves: CVE-2026-47265 Source advisory: OSV:GHSA-HG6J-4RV6-33PG...