Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CLSA-2026-1781830554 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post6+tuxcare...

CLSA-2026-1780447826 TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.6.post5+tuxcare...

CLSA-2026-1780274963 TuxCare security update for aiohttp (3 CVEs)

TuxCare rebuilt aiohttp to address 3 CVEs. Fixed in 3.8.5.post7+tuxcare...

CLSA-2026-1777423183 TuxCare security update for aiohttp (4 CVEs)

TuxCare rebuilt aiohttp to address 4 CVEs. Fixed in 3.8.4.post2+tuxcare...

CLSA-2026-1776818192 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post3+tuxcare...

CLSA-2026-1773620206 TuxCare security update for aiohttp (3 CVEs)

TuxCare rebuilt aiohttp to address 3 CVEs. Fixed in 3.8.1.post7+tuxcare...

CLSA-2026-1773188110 TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.1.post6+tuxcare...

CLSA-2026-1770163992 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post1+tuxcare...

CLSA-2026-1771373593 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post2+tuxcare...

GHSA-MFX4-HV73-Q22V AIOHTTP: HTTP request smuggling via WebSocket upgrade

Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unawar...

aiohttp TCPConnector DoS

The vulnerability of the TCPConnector HTTP-client library from aiohttp is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

PYSEC-2026-1098 aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

Summary An attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. Impact An attacker can stop the application from serving requests after sending a single...

Python Library aiohttp < 3.14.0 Header Injection

The version of the aiohttp Python library installed on the remote host is prior to 3.14.0. It is, therefore, affected by a vulnerability: - Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. I...

PYSEC-2026-2111

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be...

PYSEC-2026-2107

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This...

UBUNTU-CVE-2026-54278

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be...

UBUNTU-CVE-2026-54276

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to...

UBUNTU-CVE-2026-54279

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save and then restored later with CookieJar.load lose their host-only status. This vulnerability is fixed in 3.14.1...

UBUNTU-CVE-2026-54277

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the maxlinesize check in parts of an HTTP request in the C parser. If using the optimised C parser the default in pre-built wheels, then an attacker may be able to send...