Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs

Summary IBM Maximo Application Suite - Predict Component uses aiohttp-3.12.14-cp310-cp310-macosx109universal2.whl which are vulnerable to CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525...

Debian dla-4613 : python-aiohttp-doc - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4613 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4613-1 [email protected]...

CVE-2026-34525 vulnerabilities

Vulnerabilities for packages: request-1276, tritonserver-backend-vllm-cuda-13.0, litellm, keep-fips, keep, kserve, py3.13-scanner-test-libraries-aiohttp, kubeflow-pipelines-visualization-server, airflow, text-generation-inference, dask-kubernetes, open-webui, authentik-fips, metaflow-service,...

pushpull (0.0.2) potentially affected by CVE-2026-34525 via aiohttp (0.22.0)

aiohttp PYPI version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pushpull 0.0.2 Source cves: CVE-2026-34525 Source advisory: OSV:GHSA-C427-H43C-VF67...

aioauth-client (>=0.9.2, <=0.9.3), aiohttp-validate (>=0.1.0, <=1.0.0) +10 more potentially affected by CVE-2026-34525 via aiohttp (1.0.5)

aiohttp PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioauth-client =0.9.2, =0.1.0, =0.0.7, =0.17.0b1, =0.32.0, =1.2.0, =0.10.3, =0.1.8a1, =1.0.0a2, =1.0.0a3 Source cves: CVE-2026-34525 Source...

aiourlshortener (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-34525 via aiohttp (2.0.2)

aiohttp PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiourlshortener =0.0.1, =0.0.2 Source cves: CVE-2026-34525 Source advisory: OSV:GHSA-C427-H43C-VF67...

homeassistant (>=0.58.0, <=0.58.1), pyplanet (>=0.5.0, <=0.5.2) +1 more potentially affected by CVE-2026-34525 via aiohttp (2.3.2)

aiohttp PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.58.0, =0.5.0, =0.6.0, =0.6.2 Source cves: CVE-2026-34525 Source advisory: OSV:GHSA-C427-H43C-VF67...

0x20bf (0.0.1), 2keys (0.5.1) +3261 more potentially affected by CVE-2026-34525 via aiohttp (>=3.0.0b0, <=3.13.3)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 - ab-data-processing 0.0.1 and more Source cves: CVE-2026-34525 Source advisory: GHSA-C427-H43C-VF67...

aiodocker (0.7.0), aiopogo (>=1.6.0b1, <=2.0.0) +10 more potentially affected by CVE-2026-34525 via aiohttp (2.0.7)

aiohttp PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiodocker 0.7.0 - aiopogo =1.6.0b1, =0.1.0, =0.1.0, =0.42.4, =0.0.1, =0.9.6, =1.1.0, =1.3.3 Source cves: CVE-2026-34525 Source advisory:...

botstory (0.0.63) potentially affected by CVE-2026-34525 via aiohttp (2.0.1)

aiohttp PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory 0.0.63 Source cves: CVE-2026-34525 Source advisory: OSV:GHSA-C427-H43C-VF67...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2026-34525 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2026-34525 Source advisory: OSV:GHSA-C427-H43C-VF67...

geoffrey (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-34525 via aiohttp (0.6.4)

aiohttp PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - geoffrey =0.1.0, =0.1.2 Source cves: CVE-2026-34525 Source advisory: OSV:GHSA-C427-H43C-VF67...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2026-34525 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

aio-tinder (>=0.1.7, <=0.1.8) potentially affected by CVE-2026-34525 via aiohttp (1.0.1)

aiohttp PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.7, =0.1.8 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

s2aio (>=1.12.0, <=1.14.0) potentially affected by CVE-2026-34525 via aiohttp (0.22.4)

aiohttp PYPI version 0.22.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - s2aio =1.12.0, =1.14.0 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

aiogremlin (3.2.6rc1), aiopogo (>=2.0.2, <=2.0.4) +22 more potentially affected by CVE-2026-34525 via aiohttp (2.2.5)

aiohttp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin 3.2.6rc1 - aiopogo =2.0.2, =0.1.1, =1.0.1, =1.0.0, =1.0.0, =2.1.0rc1, =2.0.0, =0.51.0, =0.2.0, =0.0.0, =0.1.1, =1.6.2, =1.6.6 and more...

muffin (>=0.7.1, <=0.8.6) potentially affected by CVE-2026-34525 via aiohttp (0.21.6)

aiohttp PYPI version 0.21.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.7.1, =0.8.6 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

aiopogo (>=2.0.1, <=2.1.0b0), aiosparql (>=0.0.0, <=0.10.0a3) +6 more potentially affected by CVE-2026-34525 via aiohttp (2.1.0)

aiohttp PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopogo =2.0.1, =0.0.0, =0.46.0, =0.4.0, =0.0.2, =0.4.4 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2026-34525 via aiohttp (1.1.6)

aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2026-34525 Source advisory: OSV:PYSEC-2026-2103...

CVE-2026-34525

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4...