{ "@id": "urn:uuid:ef1e7547-eea5-4a5c-bb87-4da5f41cf0bd", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T17:02:39.844038+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post2+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post2+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post2+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post2+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." } ] }