| NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File OverwriteCVE-2026-33236 · GHSA-469J-VMHF-R6V7Version ranges need review. |
nltkLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| AIOHTTP: Secure attribute not enforced for shared cookieCVE-2026-111063 · GHSA-494J-54XM-RWP3 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Connector pool exhaustion via Max-Age overflowCVE-2026-111065 · GHSA-6CJC-53GC-5RQM |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Absolute-form request targets can spoof Request.schemeCVE-2026-111748 · GHSA-F9XW-JH8M-3MWQ |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesCVE-2026-111749 · GHSA-GX76-C99X-2C96 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP: File descriptor exhaustion in multipart requestsCVE-2026-111066 · GHSA-9XW5-W5JJ-PVCG |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| AIOHTTP: Pure-Python parser request smugglingCVE-2026-111750 · GHSA-PQXQ-W44R-73XW |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp server lacks an initial request/header timeoutCVE-2026-111064 · GHSA-5WR8-GCQF-GQF3 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionCVE-2026-104874 · GHSA-54P9-H82J-F925Version ranges need review. |
multidictExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: HTTP request smuggling via WebSocket upgradeCVE-2026-69243 · GHSA-MFX4-HV73-Q22VVersion ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflateCVE-2026-59881 · GHSA-MQ44-7P77-Q5H7Version ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)CVE-2026-69244 · GHSA-CQ5V-8Q36-5273Version ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| aiohttp: CRLF injection in multipart headersCVE-2026-50269 · GHSA-M6QW-4CW2-HM4MVersion ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| aiohttp: Unread Compressed Request Bodies Bypass client_max_size During CleanupCVE-2026-54278 · GHSA-G3CQ-J2XW-WF74Version ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp: HTTP/1 Pipelined Requests Queue Without LimitCVE-2026-54273 · GHSA-4FVR-RGM6-GQMCVersion ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp allows unlimited trailer headers, leading to possible uncapped memory usageCVE-2026-22815 · GHSA-W2FM-2CPV-W7V5Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP has a Multipart Header Size BypassCVE-2026-34516 · GHSA-M5QP-6W8W-W647Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnectorCVE-2026-34513 · GHSA-HCC4-C3V8-RX92Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirectCVE-2026-34518 · GHSA-966J-VMVW-G2G9Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP accepts duplicate Host headersCVE-2026-34525 · GHSA-C427-H43C-VF67Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
