Source: python-aiohttp Version: 3.14.3-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for python-aiohttp. CVE-2026-111063[0]: | AIOHTTP is an asynchronous HTTP client/server framework for asyncio | and Python. Prior to 3.14.4, the Secure attribute for a shared | cookie is not enforced. An attacker can consequently cause a shared | cookie marked Secure to be sent with an unencrypted request. This | issue is fixed in version 3.14.4. CVE-2026-111064[1]: | AIOHTTP is an asynchronous HTTP client/server framework for asyncio | and Python. Prior to 3.14.4, keepalive timeout handling is absent | during the initial portion of a request. An attacker can keep an | idle connection open indefinitely before sending any request data, | consuming server connection capacity. This issue is fixed in version | 3.14.4. CVE-2026-111065[2]: | AIOHTTP is an asynchronous HTTP client/server framework for asyncio | and Python. Prior to 3.14.4, Max-Age processing can overflow and | skip closing a connection. An attacker can consequently exhaust the | connection pool temporarily until garbage collection resolves the | connections. This issue is fixed in version 3.14.4. CVE-2026-111066[3]: | AIOHTTP is an asynchronous HTTP client/server framework for asyncio | and Python. From 2.0.0 until 3.14.4, multipart request processing | can retain an unbounded number of open file descriptors. An | unauthenticated attacker can consequently exhaust file descriptors | with specially crafted multipart requests when a handler uses | Request.post(). This issue is fixed in version 3.14.4. CVE-2026-111748[4]: | AIOHTTP is an asynchronous HTTP client/server framework for asyncio | and Python. Prior to 3.14.4, an attacker can send an absolute-form | request that causes Request.scheme to use attacker-controlled | request-target scheme data instead of the connection protocol. | Applications that use Request.scheme for security decisions can | consequently be tricked into treating an unencrypted connection as | encrypted or an encrypted connection as unencrypted. This issue is | fixed in version 3.14.4. CVE-2026-111749[5]: | AIOHTTP is an asynchronous HTTP client/server framework for asyncio | and Python. Prior to 3.14.4, Host-Only scope on an existing parent- | domain cookie can be removed by a subdomain. A user who accesses an | untrusted subdomain can consequently have host-only protections | stripped from cookies, although impact is limited when applications | do not reflect those cookies to a browser. This issue is fixed in | version 3.14.4. CVE-2026-111750[6]: | AIOHTTP is an asynchronous HTTP client/server framework for asyncio | and Python. Prior to 3.14.4, the pure Python parser accepts | ambiguous HTTP request framing. An unauthenticated attacker can | consequently smuggle requests when an application uses | AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and | an intermediary interprets the framing differently. This issue is | fixed in version 3.14.4. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-111063 https://www.cve.org/CVERecord?id=CVE-2026-111063 [1] https://security-tracker.debian.org/tracker/CVE-2026-111064 https://www.cve.org/CVERecord?id=CVE-2026-111064 [2] https://security-tracker.debian.org/tracker/CVE-2026-111065 https://www.cve.org/CVERecord?id=CVE-2026-111065 [3] https://security-tracker.debian.org/tracker/CVE-2026-111066 https://www.cve.org/CVERecord?id=CVE-2026-111066 [4] https://security-tracker.debian.org/tracker/CVE-2026-111748 https://www.cve.org/CVERecord?id=CVE-2026-111748 [5] https://security-tracker.debian.org/tracker/CVE-2026-111749 https://www.cve.org/CVERecord?id=CVE-2026-111749 [6] https://security-tracker.debian.org/tracker/CVE-2026-111750 https://www.cve.org/CVERecord?id=CVE-2026-111750 Regards, Salvatore
