gpp_maybe Security update for python-aiohttp

SUSE-SLE-Module-Public-Cloud-15-SP4-2026-3208

This update for python-aiohttp fixes the following issues: - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398). - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543). - CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544). - CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549). - CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556). - CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS (bsc#1268559). - CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560). - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).

Release Date

Jul 23 2026
References

Bugzilla: 1268398, 1268543, 1268544, 1268549, 1268556, 1268559, 1268560, 1268561
CVEs: CVE-2026-50269, CVE-2026-54273, CVE-2026-54274, CVE-2026-54275, CVE-2026-54277, CVE-2026-54278, CVE-2026-54279, CVE-2026-54280
Type

security
Severity

important

cloud_download Downloads

To download packages, you need to log in and have a valid subscription.

Public Cloud Module 15.4 aarch64

Packages

python-aiohttp
Asynchronous HTTP client/server framework

3.6.0-150100.3.38.1 lock src

python3-aiohttp
Asynchronous HTTP client/server framework

3.6.0-150100.3.38.1 lock rpm

Public Cloud Module 15.4 ppc64le

Packages

python-aiohttp
Asynchronous HTTP client/server framework

3.6.0-150100.3.38.1 lock src

python3-aiohttp
Asynchronous HTTP client/server framework

3.6.0-150100.3.38.1 lock rpm

Public Cloud Module 15.4 s390x

Packages

python-aiohttp
Asynchronous HTTP client/server framework

3.6.0-150100.3.38.1 lock src

python3-aiohttp
Asynchronous HTTP client/server framework

3.6.0-150100.3.38.1 lock rpm

Public Cloud Module 15.4 x86_64

Packages

python-aiohttp
Asynchronous HTTP client/server framework

3.6.0-150100.3.38.1 lock src

python3-aiohttp
Asynchronous HTTP client/server framework

3.6.0-150100.3.38.1 lock rpm