CVE-2026-34516

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13....

CVE-2026-34517

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking clientmaxsize. This issue has been patched in version 3.13.4...

PYSEC-2026-2094

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4...

muffin (0.5.0) potentially affected by CVE-2026-22815 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2026-22815 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (>=0.3.3, <=0.3.7) potentially affected by CVE-2026-22815 via aiohttp (0.18.4)

aiohttp PYPI version 0.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.3, =0.3.7 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (>=0.3.0, <=0.3.2) potentially affected by CVE-2026-22815 via aiohttp (0.18.3)

aiohttp PYPI version 0.18.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.0, =0.3.2 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-22815 via aiohttp (0.17.4)

aiohttp PYPI version 0.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.2.0, =0.2.1 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-22815 via aiohttp (0.17.3)

aiohttp PYPI version 0.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.5, =0.1.6 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (>=0.1.1, <=0.1.4) potentially affected by CVE-2026-22815 via aiohttp (0.17.2)

aiohttp PYPI version 0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.1, =0.1.4 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (>=0.0.107, <=0.1.0) potentially affected by CVE-2026-22815 via aiohttp (0.17.1)

aiohttp PYPI version 0.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.107, =0.1.0 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (>=0.0.105, <=0.0.106) potentially affected by CVE-2026-22815 via aiohttp (0.17.0)

aiohttp PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.105, =0.0.106 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2026-22815 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (>=0.7.1, <=0.8.6) potentially affected by CVE-2026-22815 via aiohttp (0.21.6)

aiohttp PYPI version 0.21.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.7.1, =0.8.6 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

s2aio (>=1.12.0, <=1.14.0) potentially affected by CVE-2026-22815 via aiohttp (0.22.4)

aiohttp PYPI version 0.22.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - s2aio =1.12.0, =1.14.0 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

goblin (1.0.0b1) potentially affected by CVE-2026-22815 via aiohttp (0.22.1)

aiohttp PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - goblin 1.0.0b1 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

pushpull (0.0.2) potentially affected by CVE-2026-22815 via aiohttp (0.22.0)

aiohttp PYPI version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pushpull 0.0.2 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

scriptworker (0.2.1) potentially affected by CVE-2026-22815 via aiohttp (0.22.0a0)

aiohttp PYPI version 0.22.0a0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - scriptworker 0.2.1 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (0.7.0), solo (0.0.1) potentially affected by CVE-2026-22815 via aiohttp (0.21.5)

aiohttp PYPI version 0.21.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.7.0 - solo 0.0.1 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...

muffin (>=0.6.0, <=0.6.1) potentially affected by CVE-2026-22815 via aiohttp (0.21.2)

aiohttp PYPI version 0.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.6.0, =0.6.1 Source cves: CVE-2026-22815 Source advisory: OSV:PYSEC-2026-2094...