Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the CookieJar.save and CookieJar.load functions. An attacker can cause cookies intended for a specific host to be sent to subdomains by persisting and restoring cookie...

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Summary Host-only cookies that are saved with CookieJar.save and then restored later with CookieJar.load lose their host-only status. Impact Host-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed. ----- Patch:...

aiohttp: CRLF injection in multipart headers

Summary Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. Impact In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.appendheaders=... or Payload.headers, the...

iamine (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-50269 via aiohttp (0.13.1)

aiohttp PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - iamine =0.1.5, =0.1.6 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

interest (0.0.1) potentially affected by CVE-2026-50269 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

geoffrey (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-50269 via aiohttp (0.6.4)

aiohttp PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - geoffrey =0.1.0, =0.1.2 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

muffin (0.5.0) potentially affected by CVE-2026-50269 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

muffin (>=0.1.1, <=0.1.4) potentially affected by CVE-2026-50269 via aiohttp (0.17.2)

aiohttp PYPI version 0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.1, =0.1.4 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

muffin (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-50269 via aiohttp (0.17.3)

aiohttp PYPI version 0.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.5, =0.1.6 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

muffin (>=0.0.105, <=0.0.106) potentially affected by CVE-2026-50269 via aiohttp (0.17.0)

aiohttp PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.105, =0.0.106 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

muffin (>=0.3.3, <=0.3.7) potentially affected by CVE-2026-50269 via aiohttp (0.18.4)

aiohttp PYPI version 0.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.3, =0.3.7 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

muffin (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-50269 via aiohttp (0.17.4)

aiohttp PYPI version 0.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.2.0, =0.2.1 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

muffin (>=0.0.107, <=0.1.0) potentially affected by CVE-2026-50269 via aiohttp (0.17.1)

aiohttp PYPI version 0.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.107, =0.1.0 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

muffin (>=0.3.0, <=0.3.2) potentially affected by CVE-2026-50269 via aiohttp (0.18.3)

aiohttp PYPI version 0.18.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.0, =0.3.2 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

muffin (>=0.10.0, <=0.10.2), mutaprops (>=0.6.0, <=0.6.1) potentially affected by CVE-2026-50269 via aiohttp (1.0.2)

aiohttp PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.10.0, =0.6.0, =0.6.1 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

hassmart-homeassistant (0.60.0), homeassistant (>=0.60.0, <=0.60.1) +2 more potentially affected by CVE-2026-50269 via aiohttp (2.3.6)

aiohttp PYPI version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hassmart-homeassistant 0.60.0 - homeassistant =0.60.0, =0.60.1 - pyplanet 0.5.4 - reliz 0.1.0.dev0 Source cves: CVE-2026-50269 Source advisory:...

appdaemon (>=3.0.0b2, <=3.0.0b3), balebot (>=1.2.3, <=1.8.15) +4 more potentially affected by CVE-2026-50269 via aiohttp (2.3.7)

aiohttp PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - appdaemon =3.0.0b2, =1.2.3, =0.61.1, =0.0.1, =0.2.1 - tictax 0.1.3 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

opentrons (>=3.7.0, <=3.11.4) potentially affected by CVE-2026-50269 via aiohttp (2.3.8)

aiohttp PYPI version 2.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - opentrons =3.7.0, =3.11.4 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...

aioboto3 (2.2.0), aiobotocore (>=0.5.0, <=0.5.3) +56 more potentially affected by CVE-2026-50269 via aiohttp (2.3.10)

aiohttp PYPI version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 2.2.0 - aiobotocore =0.5.0, =0.8.4, =0.1.0a1, =1.0.0, =3.0.0b4, =2.0.0, =1.1.1, =1.2.1, =2.1.0, =0.8.22, =2.0.0, =2.0.13 and more Source...

hdx-data-freshness (>=1.0.5, <=1.1.2), pyplanet (>=0.6.0rc1, <=0.10.5) potentially affected by CVE-2026-50269 via aiohttp (2.3.9)

aiohttp PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hdx-data-freshness =1.0.5, =0.6.0rc1, =0.10.5 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...