homeassistant (>=0.42.0, <=0.42.3) potentially affected by CVE-2026-34518 via aiohttp (2.0.5)

aiohttp PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.42.0, =0.42.3 Source cves: CVE-2026-34518 Source advisory: OSV:GHSA-966J-VMVW-G2G9...

muffin (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-34518 via aiohttp (0.17.4)

aiohttp PYPI version 0.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.2.0, =0.2.1 Source cves: CVE-2026-34518 Source advisory: OSV:GHSA-966J-VMVW-G2G9...

aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2026-34518 via aiohttp (1.1.5)

aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...

aiogremlin (>=3.2.4b1, <=3.2.5), goblin (2.0.0b1) +3 more potentially affected by CVE-2026-34518 via aiohttp (1.3.3)

aiohttp PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin =3.2.4b1, =0.39.0, =1.0.0b1, =1.0.0b2 - okami 0.1.4 Source cves: CVE-2026-34518 Source advisory: OSV:GHSA-966J-VMVW-G2G9...

aiopixiv (1.0.5) potentially affected by CVE-2026-34518 via aiohttp (2.0.4)

aiohttp PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv 1.0.5 Source cves: CVE-2026-34518 Source advisory: OSV:GHSA-966J-VMVW-G2G9...

aiopixiv (>=1.0.0, <=1.0.4) potentially affected by CVE-2026-34518 via aiohttp (1.1.0)

aiohttp PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv =1.0.0, =1.0.4 Source cves: CVE-2026-34518 Source advisory: OSV:GHSA-966J-VMVW-G2G9...

0x20bf (0.0.1), 2keys (0.5.1) +3261 more potentially affected by CVE-2026-34518 via aiohttp (>=3.0.0b0, <=3.13.3)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 - ab-data-processing 0.0.1 and more Source cves: CVE-2026-34518 Source advisory: OSV:GHSA-966J-VMVW-G2G9...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2026-34518 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2026-34518 Source advisory: OSV:GHSA-966J-VMVW-G2G9...

aio-tinder (>=0.1.7, <=0.1.8) potentially affected by CVE-2026-34518 via aiohttp (1.0.1)

aiohttp PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.7, =0.1.8 Source cves: CVE-2026-34518 Source advisory: OSV:GHSA-966J-VMVW-G2G9...

aioboto3 (>=1.1.0, <=2.1.0), aiobotocore (>=0.4.2, <=0.4.5) +2 more potentially affected by CVE-2026-34518 via aiohttp (2.3.0)

aiohttp PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 =1.1.0, =0.4.2, =0.4.1b31, =0.6.0b19, =0.6.0b23 Source cves: CVE-2026-34518 Source advisory: OSV:GHSA-966J-VMVW-G2G9...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2026-34518 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2026-34518 Source advisory: OSV:GHSA-966J-VMVW-G2G9...

duniterpy (0.40.8), jenkins-epo (>=1.159.0, <=1.160.0) potentially affected by CVE-2026-34518 via aiohttp (2.0.0rc1)

aiohttp PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - duniterpy 0.40.8 - jenkins-epo =1.159.0, =1.160.0 Source cves: CVE-2026-34518 Source advisory: OSV:GHSA-966J-VMVW-G2G9...

GHSA-966J-VMVW-G2G9 AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

Summary When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. Impact The Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Request.post function. An attacker can cause excessive memory allocation by sending a specially crafted multipart request containing large non-file fields. Remediation Upgrade...

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

Summary For some multipart form fields, aiohttp read the entire field into memory before checking clientmaxsize. Impact If an application uses Request.post an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimate...

homeassistant (>=0.58.0, <=0.58.1), pyplanet (>=0.5.0, <=0.5.2) +1 more potentially affected by CVE-2026-34517 via aiohttp (2.3.2)

aiohttp PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.58.0, =0.5.0, =0.6.0, =0.6.2 Source cves: CVE-2026-34517 Source advisory: OSV:GHSA-3WQ7-RQQ7-WX6J...

interest (0.0.1) potentially affected by CVE-2026-34517 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2026-34517 Source advisory: OSV:GHSA-3WQ7-RQQ7-WX6J...

okami (0.1.5) potentially affected by CVE-2026-34517 via aiohttp (2.0.3)

aiohttp PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - okami 0.1.5 Source cves: CVE-2026-34517 Source advisory: OSV:GHSA-3WQ7-RQQ7-WX6J...

aiourlshortener (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-34517 via aiohttp (2.0.2)

aiohttp PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiourlshortener =0.0.1, =0.0.2 Source cves: CVE-2026-34517 Source advisory: OSV:GHSA-3WQ7-RQQ7-WX6J...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2026-34517 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2026-34517 Source advisory: OSV:GHSA-3WQ7-RQQ7-WX6J...