CVE-2024-23334-PoC

CVE-2024-23334-PoC A proof of concept of the path traversal vulnerability in the python AioHTTP library = 3.9.1 make sure to find a valid public facing directory such as "/static/" or "/assets/" Once you find it, go in main.py and replace the /static/ string with the one you found...

CLSA-2026-1790342075 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post17+tuxcare...

aiohttp - Directory Traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

CLSA-2026-1790250538 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post14+tuxcare...

CVE-2026-54280

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. A remote attacker could exploit this vulnerability by disconnecting during a payload write, leading to improper closure of resources. This can cause temporary resource starvation, resulting in a Denial of Service DoS...

CLSA-2026-1790062887 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.4.post11+tuxcare...

SUSE SLED15 / SLES15 Security Update : python-aiohttp (SUSE-SU-2026:4031-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4031-1 advisory. - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without...

CLSA-2026-1789643644 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post15+tuxcare...

CLSA-2026-1789638581 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.4.post10+tuxcare...

CLSA-2026-1789542238 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post14+tuxcare...

CLSA-2026-1789467837 TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.6.post13+tuxcare...

SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2026:4113-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4113-1 advisory. - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated...

CLSA-2026-1789379698 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.4.post9+tuxcare...

CLSA-2026-1789132119 TuxCare security update for aiohttp (6 CVEs)

TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.1.post13+tuxcare...

CVE-2026-88001

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEBFETCHFILTERLIST or private-address controls to HTTP redirect destinations when AIOHTTPCLIENTALLOWREDIRECTS was enabled. An authenticated user...

CVE-2026-88001

Open WebUI versions 0.9.5 through 0.11.1 contained a server-side request forgery (SSRF) weakness in its web-fetch functionality. When AIOHTTP_CLIENT_ALLOW_REDIRECTS was enabled, HTTP redirect destinations were not revalidated against WEB_FETCH_FILTER_LIST or private-address controls. An authentic...

CVE-2026-88001 Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEBFETCHFILTERLIST or private-address controls to HTTP redirect destinations when AIOHTTPCLIENTALLOWREDIRECTS was enabled. An authenticated user...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.4.0 Patch6 Vulnerability Details CVEID:CVE-2026-59870 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts use...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...

SUSE-SU-2026:4113-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. - CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...