PT-2025-7771

Name of the Vulnerable Software and Affected Versions Phusion Passenger versions 6.0.21 through 6.0.25 Description The issue allows for a denial of service during parsing of a request with an invalid HTTP method, specifically affecting the http parser. Recommendations For versions 6.0.21 through...

[SECURITY] [DLA 4041-1] python-aiohttp security update

Debian LTS Advisory DLA-4041-1 [email protected] https://www.debian.org/lts/security/ Jochen Sprickerhof February 03, 2025 https://wiki.debian.org/LTS Package : python-aiohttp Version : 3.7.4-1+deb11u1 CVE ID : CVE-2023-47627 CVE-2023-47641 CVE-2023-49081 CVE-2023-49082 CVE-2024-23334...

Debian dla-4041 : python-aiohttp-doc - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4041 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4041-1 [email protected]...

PT-2025-21254

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to the llhttp v9 upgrade node-undici in Debian Linux affected versions not specified Description: A flaw in the HTTP parser of Node.js allows improper termination of HTTP/1 headers using r rX instead of the required r r...

RHSA-2019:2258 Red Hat Security Advisory: http-parser security update

Bulletin has no description...

RHSA-2019:3497 Red Hat Security Advisory: http-parser security and bug fix update

Bulletin has no description...

RHSA-2020:1510 Red Hat Security Advisory: http-parser security update

Bulletin has no description...

RHSA-2020:0707 Red Hat Security Advisory: http-parser security update

Bulletin has no description...

RHSA-2020:0708 Red Hat Security Advisory: http-parser security update

Bulletin has no description...

RHSA-2020:0703 Red Hat Security Advisory: http-parser security update

Bulletin has no description...

RHSA-2017:0002 Red Hat Security Advisory: rh-nodejs4-nodejs and rh-nodejs4-http-parser security update

Bulletin has no description...

aiohttp < 3.9.2 Multiple Vulnerabilities - Windows

aiohttp is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aio-libsproject:aiohttp";...

aiohttp < 3.9.2 Multiple Vulnerabilities - Linux

aiohttp is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aio-libsproject:aiohttp";...

RHEL 7 : rh-nodejs8-nodejs (RHSA-2018:2949)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2949 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:1640)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1640 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

DEBIAN-CVE-2024-28871

LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessive CPU usage. Version 0.5.47 contains a patch for the issue. No known workarounds are available...

BIT-NODE-2022-32214

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS...

CVE-2024-23837: Allocation of Resources Without Limits or Throttling

LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46...

Fedora 39 : python-aiohttp (2024-f249b74f03)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f249b74f03 advisory. Security update for CVE-2024-23334 and CVE-2024-23829 https://github.com/aio-libs/aiohttp/releases/tag/v3.9.2...

SUSE CVE-2024-23829

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...