SUSE-SU-2026:4031-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-20264031-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4031-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:4031-1
- Upstream
- Related
- Published
- 2026-09-07T07:46:19Z
- Modified
- 2026-09-13T18:23:17Z
- Summary
- Security update for python-aiohttp
- Details
-
This update for python-aiohttp fixes the following issues:
- CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate (bsc#1273125).
- CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
- CVE-2026-69244: out-of-bounds heap read in the C response parser while building an error message for a malformed response (bsc#1273552).
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-20264031-1/
- https://bugzilla.suse.com/1273125
- https://bugzilla.suse.com/1273552
- https://bugzilla.suse.com/1273553
- https://www.suse.com/security/cve/CVE-2026-59881
- https://www.suse.com/security/cve/CVE-2026-69243
- https://www.suse.com/security/cve/CVE-2026-69244
Affected packages
SUSE:Linux Enterprise Module for Public Cloud 15 SP4 / python-aiohttp
Package
- Name
- python-aiohttp
- Purl
- pkg:rpm/suse/python-aiohttp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP4