muffin (0.5.1) potentially affected by CVE-2026-59881 via aiohttp (0.20.1)

aiohttp PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.1 Source cves: CVE-2026-59881 Source advisory: OSV:GHSA-MQ44-7P77-Q5H7...

aiohttp-cors (0.3.0), aslack (0.11.0) +1 more potentially affected by CVE-2026-59881 via aiohttp (0.20.2)

aiohttp PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiohttp-cors 0.3.0 - aslack 0.11.0 - muffin =0.5.2, =0.5.12 Source cves: CVE-2026-59881 Source advisory: OSV:GHSA-MQ44-7P77-Q5H7...

muffin (0.5.0) potentially affected by CVE-2026-59881 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2026-59881 Source advisory: OSV:GHSA-MQ44-7P77-Q5H7...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2026-59881 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2026-59881 Source advisory: OSV:GHSA-MQ44-7P77-Q5H7...

hassmart-homeassistant (0.60.0), homeassistant (>=0.60.0, <=0.60.1) +2 more potentially affected by CVE-2026-59881 via aiohttp (2.3.6)

aiohttp PYPI version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hassmart-homeassistant 0.60.0 - homeassistant =0.60.0, =0.60.1 - pyplanet 0.5.4 - reliz 0.1.0.dev0 Source cves: CVE-2026-59881 Source advisory:...

hassmart-homeassistant (>=0.59.2, <=0.59.2.1), homeassistant (>=0.59.0, <=0.59.2) potentially affected by CVE-2026-59881 via aiohttp (2.3.5)

aiohttp PYPI version 2.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hassmart-homeassistant =0.59.2, =0.59.0, =0.59.2 Source cves: CVE-2026-59881 Source advisory: OSV:GHSA-MQ44-7P77-Q5H7...

appdaemon (>=3.0.0b2, <=3.0.0b3), balebot (>=1.2.3, <=1.8.15) +4 more potentially affected by CVE-2026-59881 via aiohttp (2.3.7)

aiohttp PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - appdaemon =3.0.0b2, =1.2.3, =0.61.1, =0.0.1, =0.2.1 - tictax 0.1.3 Source cves: CVE-2026-59881 Source advisory: OSV:GHSA-MQ44-7P77-Q5H7...

aiobotocore (0.2.3), aiobotocore-botorange (>=0.1.0, <=0.2.3a0) +9 more potentially affected by CVE-2026-59881 via aiohttp (1.3.5)

aiohttp PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiobotocore 0.2.3 - aiobotocore-botorange =0.1.0, =0.0.3a0, =1.2.0, =1.0.0, =3.0.2, =3.0.5 Source cves: CVE-2026-59881 Source advisory:...

aiopixiv (1.0.5) potentially affected by CVE-2026-59881 via aiohttp (2.0.4)

aiohttp PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv 1.0.5 Source cves: CVE-2026-59881 Source advisory: OSV:GHSA-MQ44-7P77-Q5H7...

homeassistant (>=0.42.0, <=0.42.3) potentially affected by CVE-2026-59881 via aiohttp (2.0.5)

aiohttp PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.42.0, =0.42.3 Source cves: CVE-2026-59881 Source advisory: OSV:GHSA-MQ44-7P77-Q5H7...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs

Summary IBM Maximo Application Suite - Predict Component uses aiohttp-3.12.14-cp310-cp310-macosx109universal2.whl which are vulnerable to CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Predict Component uses click-8.3.1-py3-none-any.whl,aiohttp-3.12.14-cp310-cp310-macosx109universal2.whl which are vulnerable to CVE-2026-7246, CVE-2025-69223, CVE-2025-69224, CVE-2025-69225, CVE-2025-69226, CVE-2025-69227, CVE-2025-69228, CVE-2025-69229,...

CVE-2026-69243: Inconsistent Interpretation of HTTP Requests

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

CVE-2026-69244: Uncontrolled Resource Consumption

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

PT-2026-67521

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.3 Description An out-of-bounds heap read can occur in the C response parser when constructing an error message for a malformed response. This happens in the aiohttp/ http parser.pyx file, where an llhttp...

SUSE CVE-2026-59881

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...

AZL-94397 CVE-2026-59881 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...

CVE-2026-59881

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...

CVE-2026-59881

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...

UBUNTU-CVE-2026-59881

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...