{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7b316807-3f28-5827-98ed-4d86b68a31cf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "type": "library", "bom-ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "version": "3.8.6.post15+tuxcare", "pedigree": { "ancestors": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6", "type": "library", "version": "3.8.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-37276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:d6d20fe6-a0e8-5668-8e96-3e01cff27485", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "code_not_present" } }, { "id": "CVE-2023-47627", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:fc3670c8-cc23-507e-8bd7-9bef733887e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "code_not_present" } }, { "id": "CVE-2023-49081", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:fd1fe64d-f3b5-5ce1-95a2-dd6150a9acee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2023-49082", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:62677276-8f13-5216-9753-42842848a6c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2024-23334", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:7ebe7b7f-dbd0-5270-a721-40e8a7f1b11a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2024-23829", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:2114109a-bb28-5fbd-a055-5cdabf27b921", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2024-27306", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:a03ca22a-984a-52bc-b384-51fad97b757f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2024-30251", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:e70a18f6-ddd5-5314-84af-e5beae52451d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2024-52304", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:8d2a8459-b420-5faf-ab6f-599f81f5c873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-53643", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:34c3e847-d766-55ad-9777-048b9a83ea1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69223", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:2becafaf-be38-58ad-aec0-8d0e697211da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69224", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:f307df21-553b-5adf-bf7d-8a2c34ac77d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69225", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:f4db5a5f-7d96-574b-9148-7545c187d78d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69226", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:4cc86abf-a43c-5469-acc7-3a37946a1c06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69227", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:cfa3bb40-302f-5a23-a6f6-6322a9243294", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69228", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:d530afea-f18b-591c-bac1-dcd663b8b586", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69229", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:9ce25d2d-29d7-51a3-84a8-c7bca89f318b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69230", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:d4031634-5094-5c8b-abe9-e7154416668a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post15+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "code_not_present" } }, { "id": "CVE-2026-111063", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:cdd2d3bc-40f3-52f7-8e36-024ac883ce30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111063 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." } }, { "id": "CVE-2026-111064", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:f73754c3-15cd-5138-a5cc-844f439b9375", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111064 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." } }, { "id": "CVE-2026-111065", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:3304087b-90ee-5d6b-9f73-4ed1bc29c2c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111065 affects version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-111066", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:ded3d617-00c1-5c8c-896b-4811b2f4b250", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111066 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." } }, { "id": "CVE-2026-111748", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:2b8ab4ae-d3b5-5880-a188-f25711f95583", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111748 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." } }, { "id": "CVE-2026-111749", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:a37e2803-4279-55bf-b224-d19a0cc0faa4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-111750", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:d24eb0c4-76b1-5e11-80cb-4b2f3271be53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111750 affects version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-22815", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:27aa1022-0845-530f-9c02-660b3ff00382", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34513", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:cd495b64-1e08-5298-84ad-25e2b65a3a14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34514", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:a6b66660-5917-5062-aafb-d4a1b273bac3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34515", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:ca3ff5f8-57a3-57dd-a088-74d1ab94f268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34516", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:7f84f703-9610-560d-849c-3ab7a1ee4a05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34517", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:cdd45c37-300d-508f-82e3-a77ca4960e6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34518", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:8182f0bb-f679-5d2c-9dd2-e2ff591b5818", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34519", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:6fdcd08c-b4e3-526b-bad6-862102a58b10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34520", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:92ce7788-adad-5f5c-8472-d844ed9b0649", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34525", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:7df2ad14-07e0-54ec-bb66-22a5371bf206", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34993", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:f21716c6-c737-5ee2-b2ec-b0ac28969fe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-47265", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:01c24881-5068-55aa-8fbb-5296ea75a022", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-50269", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:602907d8-1521-57c0-a47b-6d40a5b7e6e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54273", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:ecbe9871-7d99-5c67-aa29-71e90c8ac521", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54274", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:b55237e8-8ac3-5876-8d27-e96376c001f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54275", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:6478f230-bdc9-5540-96e4-c45922181a69", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:934918ae-a8ab-5449-9d56-6cf4cea03fd1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-54277", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:f7bf4eae-7cdb-595f-98cc-c24daa1a7a1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54278", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:1a2cad86-9f55-5979-9895-ea7a01d21a05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54279", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:421f3362-5f26-5d26-8e25-906d50ffa6de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54280", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:864b0d14-9476-5189-b505-5841241d8327", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post15+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "code_not_present" } }, { "id": "CVE-2026-59881", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:711bffd1-eae5-54fc-86f3-28debea1450d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-69243", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:8ab53629-bd33-5703-b7c8-d2c4d7a01253", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-69244", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:3321a063-1fcd-5363-8605-ff1207e88e27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "GHSA-2g87-pp6c-29x5", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:b6237afd-c6c0-5a12-a9cc-8e0d2d6d05c5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "GHSA-pjjw-qhg8-p2p9", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:62377397-e535-568a-a9bb-7d81a1380c03", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ] }