Back Linuxsecurity

openSUSE Python-aiohttp Important DoS Threat Advisory 2026-3207

Linuxsecurity •LinuxSecurity Advisories • July 24, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

This update for python-aiohttp fixes the following issues

* CVE-2026-22815: insufficient restrictions in header/trailer handling can

cause uncapped memory usage and a denial of service (bsc#1261320).

* CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and

lead to a denial of service (bsc#1261321).

* CVE-2026-34514: `content_type` parameter manipulation can lead to header

injection (bsc#1261322).

* CVE-2026-34516: response with excessive multipart headers can use more

memory than intended and cause a denial of service (bsc#1261329).

* CVE-2026-34517: large multipart form fields read into memory without size

check can cause a denial of service (bsc#1261331).

* CVE-2026-34518: retained `Cookie` and `Proxy-Authorization` headers when

following redirects can lead to information disclosure (bsc#1261332).

* CVE-2026-34519: response `reason` parameter can be use to perform header

injection (bsc#1261334).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-3207=1

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-3207=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-3207=1

* Python 3 Module 15-SP7

zypper in -t patch SUSE-SLE-Module-Python3-15-SP7-2026-3207=1

zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-3207=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3207=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4

zypper in -t patch...