0x20bf (0.0.1), 2keys (0.5.1) +3456 more potentially affected by CVE-2026-54275 via aiohttp (>=3.0.0b0, <=3.14.0)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =3.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 and more Source cves: CVE-2026-54275 Source advisory: GHSA-4M7W-QMGQ-4WJ5...

0x20bf (0.0.1), 2keys (0.5.1) +3456 more potentially affected by CVE-2026-54275 via aiohttp (>=3.0.0b0, <=3.14.0)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =3.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 and more Source cves: CVE-2026-54275 Source advisory: SNYK:PYTHON-AIOHTTP-17342400...

0x20bf (0.0.1), 2keys (0.5.1) +3456 more potentially affected by CVE-2026-54275 via aiohttp (>=3.0.0b0, <=3.14.0)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =3.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 and more Source cves: CVE-2026-54275 Source advisory: OSV:GHSA-4M7W-QMGQ-4WJ5...

echod (0.1.0), muffin (>=0.0.94, <=0.0.97) potentially affected by CVE-2026-54275 via aiohttp (0.16.5)

aiohttp PYPI version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - echod 0.1.0 - muffin =0.0.94, =0.0.97 Source cves: CVE-2026-54275 Source advisory: OSV:GHSA-4M7W-QMGQ-4WJ5...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2026-54275 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2026-54275 Source advisory: OSV:GHSA-4M7W-QMGQ-4WJ5...

muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2026-54275 via aiohttp (0.14.1)

aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2026-54275 Source advisory: OSV:GHSA-4M7W-QMGQ-4WJ5...

muffin (>=0.0.23, <=0.0.45) potentially affected by CVE-2026-54275 via aiohttp (0.14.4)

aiohttp PYPI version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.23, =0.0.45 Source cves: CVE-2026-54275 Source advisory: OSV:GHSA-4M7W-QMGQ-4WJ5...

muffin (>=0.0.46, <=0.0.52) potentially affected by CVE-2026-54275 via aiohttp (0.15.0)

aiohttp PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.46, =0.0.52 Source cves: CVE-2026-54275 Source advisory: OSV:GHSA-4M7W-QMGQ-4WJ5...

goblin (1.0.0b1) potentially affected by CVE-2026-54275 via aiohttp (0.22.1)

aiohttp PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - goblin 1.0.0b1 Source cves: CVE-2026-54275 Source advisory: OSV:GHSA-4M7W-QMGQ-4WJ5...

s2aio (>=1.12.0, <=1.14.0) potentially affected by CVE-2026-54275 via aiohttp (0.22.4)

aiohttp PYPI version 0.22.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - s2aio =1.12.0, =1.14.0 Source cves: CVE-2026-54275 Source advisory: OSV:GHSA-4M7W-QMGQ-4WJ5...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the serverhostname parameter handling during HTTPS connection reuse. An attacker can bypass intended TLS SNI checks by reusing an existing connection with a different...

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Summary The serverhostname TLS SNI check can be bypassed when an existing connection is reused. Impact If an application makes multiple requests to the same domain, but with different per-request serverhostname parameters, then the later calls may succeed by reusing the existing connection when...

GHSA-9X8Q-7H8H-WCW9 aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

Summary Payload resources are not closed correctly when a client disconnects in the middle of a write. Impact If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file...

interest (0.0.1) potentially affected by CVE-2026-54280 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

iamine (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-54280 via aiohttp (0.13.1)

aiohttp PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - iamine =0.1.5, =0.1.6 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

geoffrey (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-54280 via aiohttp (0.6.4)

aiohttp PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - geoffrey =0.1.0, =0.1.2 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2026-54280 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

muffin (0.5.0) potentially affected by CVE-2026-54280 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

muffin (>=0.1.1, <=0.1.4) potentially affected by CVE-2026-54280 via aiohttp (0.17.2)

aiohttp PYPI version 0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.1, =0.1.4 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...

muffin (>=0.0.105, <=0.0.106) potentially affected by CVE-2026-54280 via aiohttp (0.17.0)

aiohttp PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.105, =0.0.106 Source cves: CVE-2026-54280 Source advisory: OSV:GHSA-9X8Q-7H8H-WCW9...