SUSE-SU-2026:3207-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2026/suse-su-20263207-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2026:3207-1

Upstream

CVE (19)

Related

CVE (19)

Published

2026-07-23T14:10:50Z

Modified

2026-07-24T17:16:06Z

Summary

Security update for python-aiohttp

Details

This update for python-aiohttp fixes the following issues

CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service (bsc#1261320).
CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321).
CVE-2026-34514: content_type parameter manipulation can lead to header injection (bsc#1261322).
CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of service (bsc#1261329).
CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service (bsc#1261331).
CVE-2026-34518: retained Cookie and Proxy-Authorization headers when following redirects can lead to information disclosure (bsc#1261332).
CVE-2026-34519: response reason parameter can be use to perform header injection (bsc#1261334).
CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).
CVE-2026-34525: multiple Host headers allow for potential security bypass in proxy servers (bsc#1261343).
CVE-2026-34993: loading untrusted input in CookieJar.load() can lead to arbitrary code execution (bsc#1267471).
CVE-2026-47265: cookies set with the cookies parameter on requests are sent after following a cross-origin redirect and can leak sensitive data (bsc#1267561).
CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398).
CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543).
CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544).
CVE-2026-54275: server_hostname TLS SNI check bypass when an existing connection is reused (bsc#1268549).
CVE-2026-54277: max_line_size bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556).
CVE-2026-54278: unread compressed request bodies can bypass client_max_size during cleanup and cause a DoS (bsc#1268559).
CVE-2026-54279: host-only cookies become domain cookies after CookieJar persistence (bsc#1268560).
CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).

References

Affected packages

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"

SUSE:Linux Enterprise Module for Public Cloud 15 SP4

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"

SUSE:Linux Enterprise Module for Python 3 15 SP7

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP7

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"

SUSE:Linux Enterprise Server 15 SP4-LTSS

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"

SUSE:Linux Enterprise Server 15 SP5-LTSS

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"

SUSE:Linux Enterprise Server 15 SP6-LTSS

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP4

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP5

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP6

python-aiohttp

Package

Name: python-aiohttp
Purl: pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3-150400.10.43.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-aiohttp":  "3.9.3-150400.10.43.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3207-1.json"