Skip to content

Commit 3b60504

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3wq7-rqq7-wx6j GHSA-966j-vmvw-g2g9 GHSA-mwh4-6h8g-pg8w
1 parent 9e5b1e2 commit 3b60504

3 files changed

Lines changed: 216 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-3wq7-rqq7-wx6j/GHSA-3wq7-rqq7-wx6j.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3wq7-rqq7-wx6j",
4+
"modified": "2026-04-01T21:47:07Z",
5+
"published": "2026-04-01T21:47:07Z",
6+
"aliases": [
7+
"CVE-2026-34517"
8+
],
9+
"summary": "AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS",
10+
"details": "### Summary\n\nFor some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.\n\n### Impact\n\nIf an application uses `Request.post()` an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "aiohttp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.13.4"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.13.3"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3wq7-rqq7-wx6j"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34517"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145"
53+
},
54+
{
55+
"type": "PACKAGE",
56+
"url": "https://github.com/aio-libs/aiohttp"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"
61+
}
62+
],
63+
"database_specific": {
64+
"cwe_ids": [
65+
"CWE-770"
66+
],
67+
"severity": "LOW",
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-04-01T21:47:07Z",
70+
"nvd_published_at": "2026-04-01T21:16:59Z"
71+
}
72+
}

‎advisories/github-reviewed/2026/04/GHSA-966j-vmvw-g2g9/GHSA-966j-vmvw-g2g9.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-966j-vmvw-g2g9",
4+
"modified": "2026-04-01T21:47:46Z",
5+
"published": "2026-04-01T21:47:46Z",
6+
"aliases": [
7+
"CVE-2026-34518"
8+
],
9+
"summary": "AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect",
10+
"details": "### Summary\n\nWhen following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.\n\n### Impact\n\nThe Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "aiohttp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.13.4"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.13.3"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34518"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6"
53+
},
54+
{
55+
"type": "PACKAGE",
56+
"url": "https://github.com/aio-libs/aiohttp"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"
61+
}
62+
],
63+
"database_specific": {
64+
"cwe_ids": [
65+
"CWE-200"
66+
],
67+
"severity": "LOW",
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-04-01T21:47:46Z",
70+
"nvd_published_at": "2026-04-01T21:17:00Z"
71+
}
72+
}

‎advisories/github-reviewed/2026/04/GHSA-mwh4-6h8g-pg8w/GHSA-mwh4-6h8g-pg8w.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mwh4-6h8g-pg8w",
4+
"modified": "2026-04-01T21:48:24Z",
5+
"published": "2026-04-01T21:48:24Z",
6+
"aliases": [
7+
"CVE-2026-34519"
8+
],
9+
"summary": "AIOHTTP has HTTP response splitting via \\r in reason phrase",
10+
"details": "### Summary\n\nAn attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.\n\n### Impact\n\nIn the unlikely situation that an application allows untrusted data to be used in the response's `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "aiohttp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.13.4"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.13.3"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8w"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34519"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b"
53+
},
54+
{
55+
"type": "PACKAGE",
56+
"url": "https://github.com/aio-libs/aiohttp"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"
61+
}
62+
],
63+
"database_specific": {
64+
"cwe_ids": [
65+
"CWE-113"
66+
],
67+
"severity": "LOW",
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-04-01T21:48:24Z",
70+
"nvd_published_at": "2026-04-01T21:17:00Z"
71+
}
72+
}

0 commit comments

Comments
 (0)