PYSEC-2026-237

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the serverhostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request serverhostname...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2026-54275 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2026-54275 Source advisory: OSV:PYSEC-2026-237...

echod (0.1.0), muffin (>=0.0.94, <=0.0.97) potentially affected by CVE-2026-54275 via aiohttp (0.16.5)

aiohttp PYPI version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - echod 0.1.0 - muffin =0.0.94, =0.0.97 Source cves: CVE-2026-54275 Source advisory: OSV:PYSEC-2026-237...

muffin (>=0.0.46, <=0.0.52) potentially affected by CVE-2026-54280 via aiohttp (0.15.0)

aiohttp PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.46, =0.0.52 Source cves: CVE-2026-54280 Source advisory: OSV:PYSEC-2026-2113...

muffin (>=0.0.23, <=0.0.45) potentially affected by CVE-2026-54275 via aiohttp (0.14.4)

aiohttp PYPI version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.23, =0.0.45 Source cves: CVE-2026-54275 Source advisory: OSV:PYSEC-2026-237...

muffin (>=0.0.23, <=0.0.45) potentially affected by CVE-2026-54280 via aiohttp (0.14.4)

aiohttp PYPI version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.23, =0.0.45 Source cves: CVE-2026-54280 Source advisory: OSV:PYSEC-2026-2113...

interest (0.0.1) potentially affected by CVE-2026-54280 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2026-54280 Source advisory: OSV:PYSEC-2026-2113...

interest (0.0.1) potentially affected by CVE-2026-54278 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2026-54278 Source advisory: OSV:PYSEC-2026-2111...

interest (0.0.1) potentially affected by CVE-2026-54277 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2026-54277 Source advisory: OSV:PYSEC-2026-2110...

muffin (>=0.1.1, <=0.1.4) potentially affected by CVE-2026-54280 via aiohttp (0.17.2)

aiohttp PYPI version 0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.1, =0.1.4 Source cves: CVE-2026-54280 Source advisory: OSV:PYSEC-2026-2113...

muffin (>=0.1.1, <=0.1.4) potentially affected by CVE-2026-54277 via aiohttp (0.17.2)

aiohttp PYPI version 0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.1, =0.1.4 Source cves: CVE-2026-54277 Source advisory: OSV:PYSEC-2026-2110...

PYSEC-2026-2109

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to...

aioboto3 (2.2.0), aiobotocore (>=0.5.0, <=0.5.3) +56 more potentially affected by CVE-2026-54280 via aiohttp (2.3.10)

aiohttp PYPI version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 2.2.0 - aiobotocore =0.5.0, =0.8.4, =0.1.0a1, =1.0.0, =3.0.0b4, =2.0.0, =1.1.1, =1.2.1, =2.1.0, =0.8.22, =2.0.0, =2.0.13 and more Source...

hdx-data-freshness (>=1.0.5, <=1.1.2), pyplanet (>=0.6.0rc1, <=0.10.5) potentially affected by CVE-2026-54277 via aiohttp (2.3.9)

aiohttp PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hdx-data-freshness =1.0.5, =0.6.0rc1, =0.10.5 Source cves: CVE-2026-54277 Source advisory: OSV:PYSEC-2026-2110...

opentrons (>=3.7.0, <=3.11.4) potentially affected by CVE-2026-54279 via aiohttp (2.3.8)

aiohttp PYPI version 2.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - opentrons =3.7.0, =3.11.4 Source cves: CVE-2026-54279 Source advisory: OSV:PYSEC-2026-2112...

0x20bf (0.0.1), 2keys (0.5.1) +3456 more potentially affected by CVE-2026-54278 via aiohttp (>=3.0.0b0, <=3.14.0)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =3.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 and more Source cves: CVE-2026-54278 Source advisory: OSV:PYSEC-2026-2111...

opentrons (>=3.7.0, <=3.11.4) potentially affected by CVE-2026-54277 via aiohttp (2.3.8)

aiohttp PYPI version 2.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - opentrons =3.7.0, =3.11.4 Source cves: CVE-2026-54277 Source advisory: OSV:PYSEC-2026-2110...

pyplanet (0.5.3) potentially affected by CVE-2026-54279 via aiohttp (2.3.3)

aiohttp PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyplanet 0.5.3 Source cves: CVE-2026-54279 Source advisory: OSV:PYSEC-2026-2112...

pyplanet (0.5.3) potentially affected by CVE-2026-54277 via aiohttp (2.3.3)

aiohttp PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyplanet 0.5.3 Source cves: CVE-2026-54277 Source advisory: OSV:PYSEC-2026-2110...

homeassistant (>=0.58.0, <=0.58.1), pyplanet (>=0.5.0, <=0.5.2) +1 more potentially affected by CVE-2026-54277 via aiohttp (2.3.2)

aiohttp PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.58.0, =0.5.0, =0.6.0, =0.6.2 Source cves: CVE-2026-54277 Source advisory: OSV:PYSEC-2026-2110...