Back Linuxsecurity openSUSE Python-Aiohttp Important Resource Issues Vuln 2026-21372
Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges ×
This update for python-aiohttp fixes the following issues
- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers
- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption
- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive
resource consumption (bsc#1268544).
- CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549).
- CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource
consumption (bsc#1268556).
- CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS
- CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).
- CVE-2026-54280: payload resources are not closed...
- openSUSE Leap 16.0:
python313-aiohttp-3.11.16-160000.6.1
*
*
*
*
*
*
*
*
Get the latest Linux and open source security news straight to your inbox.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
