1611 matches found
PT-2026-89178
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.11.0 Description An authenticated user can perform a Server-Side Request Forgery SSRF attack when the AIOHTTP CLIENT ALLOW REDIRECTS variable is set to true. The platform fails to reapply the WEB FETCH FILTE...
CLSA-2026-1787915974 TuxCare security update for aiohttp (2 CVEs)
TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.6.post11+tuxcare...
CLSA-2026-1787906503 TuxCare security update for aiohttp (7 CVEs)
TuxCare rebuilt aiohttp to address 7 CVEs. Fixed in 3.8.6.post10+tuxcare...
CLSA-2026-1787905713 TuxCare security update for aiohttp (2 CVEs)
TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.4.post7+tuxcare...
PT-2026-83124
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.17.1 Description Remote attackers can cause a Denial of Service through memory exhaustion. The AsyncMediaIO.fetch audio and AsyncMediaIO.fetch image functions in multimodal/inputs.py use aiohttp to fetch user-supplied...
CVE-2026-37237
The vLLM library (up to and including version 0.17.0 ) is vulnerable to a Denial of Service (DoS) via memory exhaustion. The root cause lies in the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions within multimodal/inputs.py. These functions utilize the aiohttp library to fetch use...
CLSA-2026-1787723258 TuxCare security update for aiohttp (3 CVEs)
TuxCare rebuilt aiohttp to address 3 CVEs. Fixed in 3.8.5.post10+tuxcare...
aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...
aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...
aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...
aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...
aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...
aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...
Fedora 45 : python-aiohttp (2026-e76e1f737b)
The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e76e1f737b advisory. Automatic update for python-aiohttp-3.14.3-3.fc45. Changelog Mon Aug 24 2026 Benjamin A. Beasley - 3.14.3-3 - Preemptively patch for Cython 3.3...
Fedora 46 : python-aiohttp (2026-84f7af8f97)
The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-84f7af8f97 advisory. Automatic update for python-aiohttp-3.14.3-3.fc46. Changelog Mon Aug 24 2026 Benjamin A. Beasley - 3.14.3-3 - Preemptively patch for Cython 3.3...
ROOT-APP-PYPI-CVE-2026-54277 CVE-2026-54277 in aiohttp - Patched by Root
Root has patched CVE-2026-54277 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-54275 CVE-2026-54275 in aiohttp - Patched by Root
Root has patched CVE-2026-54275 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-34515 CVE-2026-34515 in aiohttp - Patched by Root
Root has patched CVE-2026-34515 in the aiohttp package for Root:PyPI. Multiple fixed versions available...