This update for python-aiohttp fixes the following issues:
- CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated
permessage-deflate (bsc#1273125).
- CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
- CVE-2026-69244: out-of-bounds heap read in the C response parser while building an error message for a malformed
response (bsc#1273552).
This update for python-aiohttp fixes the following issues
- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers
(bsc#1268398).
- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption
(bsc#1268543).
- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive
resource consumption (bsc#1268544).
- CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549).
- CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP par
This update for python-aiohttp fixes the following issues
- CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
- CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
- CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
- CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
- CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
- CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure
(bsc#126
This update for python-aiohttp, python-Brotli fixes the following issues:
Changes in python-aiohttp:
- CVE-2025-69228: Fixed denial of service through large payloads (bsc#1256022).
- CVE-2025-69226: Fixed brute-force leak of internal static file path components (bsc#1256020).
- CVE-2025-69224: Fixed unicode processing of header values could cause parsing discrepancies (bsc#1256018).
- CVE-2025-69223: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017).
- CVE-2025-69227: Fixed DoS when bypassing asserts (bsc#1256021).
- CVE-2025-69225: Fixed unicode match groups in regexes for ASCII protocol elements (bsc#