| zip: AES Entry HMAC Authentication Bypass on Premature EOFCVE-2026-115906 · GHSA-8HXF-QR8P-62X4 |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Secure attribute not enforced for shared cookieCVE-2026-111063 · GHSA-494J-54XM-RWP3 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Connector pool exhaustion via Max-Age overflowCVE-2026-111065 · GHSA-6CJC-53GC-5RQM |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Absolute-form request targets can spoof Request.schemeCVE-2026-111748 · GHSA-F9XW-JH8M-3MWQ |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesCVE-2026-111749 · GHSA-GX76-C99X-2C96 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP: File descriptor exhaustion in multipart requestsCVE-2026-111066 · GHSA-9XW5-W5JJ-PVCG |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| AIOHTTP: Pure-Python parser request smugglingCVE-2026-111750 · GHSA-PQXQ-W44R-73XW |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp server lacks an initial request/header timeoutCVE-2026-111064 · GHSA-5WR8-GCQF-GQF3 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionCVE-2026-104874 · GHSA-54P9-H82J-F925Version ranges need review. |
multidictExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| webpki: Name constraints were accepted for certificates asserting a wildcard nameCVE-2026-93601 · GHSA-XGP8-3HG3-C2MHVersion ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logicCVE-2026-93602 · GHSA-PWJX-QHCG-RVJ4Version ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflateCVE-2026-59881 · GHSA-MQ44-7P77-Q5H7Version ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp: CRLF injection in multipart headersCVE-2026-50269 · GHSA-M6QW-4CW2-HM4MVersion ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| aiohttp: Unread Compressed Request Bodies Bypass client_max_size During CleanupCVE-2026-54278 · GHSA-G3CQ-J2XW-WF74Version ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp: HTTP/1 Pipelined Requests Queue Without LimitCVE-2026-54273 · GHSA-4FVR-RGM6-GQMCVersion ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect ChallengesCVE-2026-54276 · GHSA-HPJ7-WQ8M-9HGPVersion ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP is vulnerable to cross-origin redirect with per-request cookiesCVE-2026-47265 · GHSA-HG6J-4RV6-33PGVersion ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS ConnectionsCVE-2026-54275 · GHSA-4M7W-QMGQ-4WJ5Version ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixCVE-2026-45409 · GHSA-65PC-FJ4G-8RJXVersion ranges need review. |
idnaConfidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
