{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:80f975b3-5d8f-5ae8-be8c-6d1843852d8b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "type": "library", "bom-ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "version": "3.8.1.post16+tuxcare", "pedigree": { "ancestors": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.1", "type": "library", "version": "3.8.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-33124", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:07f215e1-c510-5e64-8c4d-c3c433e198dc", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post16+tuxcare." } }, { "id": "CVE-2023-37276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:939931be-f29f-5e44-803c-54d07b58d9c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2023-47627", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:2cf9f67a-6930-5f7b-afcc-5d8984cd9c86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2023-49081", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:3e6baa7b-371b-50df-b7a9-067930b9e148", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2023-49082", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:1e7874df-65b0-57f2-aefa-68b1ba67a5b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2024-23334", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:f0f35395-484c-5c44-a933-3bf754586b0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2024-23829", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:1c58fe0a-33ca-5f6f-9dc2-d7487db7cc85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2024-27306", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:ed0b9f41-aa16-5897-a8cb-88e8a81cf5f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2024-30251", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:999756fa-25ba-51ea-a632-0e0af43951b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2024-52304", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:ba5e8589-a24a-52fb-91b1-e77190d4020e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-53643", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:49b35daf-3a3e-5865-b0b2-38c8d0183aba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69223", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:cf553c80-976f-5e3f-8cd8-8e8bb65fce15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69224", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:2b222c59-240e-5075-9661-18ad10059ba8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69225", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:f27a8370-69c8-5387-bb85-55b425ac6685", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69226", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:f2b0f9b8-90f9-58fa-8cb3-829d5465c7cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69226 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69227", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:8c99190c-cca9-5bb4-a93b-4783deaab0aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69228", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:f933b14d-4970-5ee7-a911-b0504d2fab3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69229", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:b533f8d4-6d78-5d72-b1ba-075d316f8dae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69230", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:371927eb-87ec-52a1-aa68-b07005327a2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69230 affects version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-111063", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:250b07dc-8b8e-51c9-90e2-8ae61836c4a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111063 affects version 3.8.1.post16+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." } }, { "id": "CVE-2026-111064", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:a11eef1a-40c3-5e28-ab87-31af9ba8a12e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111064 affects version 3.8.1.post16+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." } }, { "id": "CVE-2026-111065", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:9a330728-5868-5e99-8e0e-4f874e842288", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111065 affects version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-111066", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:2bf7d319-8aed-5546-a470-bef6bd5a71b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111066 affects version 3.8.1.post16+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." } }, { "id": "CVE-2026-111748", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:5bbbaf9d-86e9-5110-ad65-2ce16f7af57c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111748 affects version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-111749", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:31760f35-2e45-553e-9ade-ad04b032ea49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111749 affects version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-111750", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:c3b5d69a-0f7d-53d1-94b2-1f6393a6c42e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111750 affects version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-22815", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:7951aff9-5b31-570b-8fd0-35d7b453aed0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34513", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:b3c3d71a-db2a-523c-a832-d139b7a782fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34514", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:f4859dca-f999-524e-9d5b-72d78e256b54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34515", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:3e7b748b-3dcb-5e14-9a19-dc87953dfd79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34515 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34516", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:ecc7bcb9-1ea9-53fd-b3ed-8cb790529b3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34517", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:069c0a6e-d418-5643-b15c-769aac57772f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34518", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:1d9376f7-c281-5ae7-a2cb-6bf2cc6f1591", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34519", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:b2e29f33-7e5a-5f33-9878-82c6d28f41c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34520", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:04e893b6-fbc7-5d14-a216-1de2dfeb555e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34525", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:fb5a0946-4d50-55d4-9e00-18d27051d187", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34993", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:632d5cf2-27ec-55c6-9699-363035221a96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34993 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-47265", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:4ed4f7cc-3f0e-5ff9-96a0-0169c22d65bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-50269", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:a6a2fa52-0507-5b61-9de0-e764613fbac4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54273", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:5cc2fd94-0f14-5189-a683-6140b41c8c7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54274", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:d6e11d25-342a-56cf-abb6-b055e280055a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54275", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:6c21135d-60cb-5d55-aaed-3968efde0c4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post16+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-54276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:1e48c546-03e8-5fe4-91c2-b993e48b6266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post16+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54277", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:d8f120b4-ac5b-5b55-82ad-58dfaadbd311", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54278", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:5dfa3516-f7f4-5c89-b7d5-8f94503be02c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54278 affects version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54279", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:f354e83e-69d5-59c6-8976-4259b4d89994", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54280", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:5707ba26-3699-52b8-9b96-b8e795bb56f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post16+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "code_not_present" } }, { "id": "CVE-2026-59881", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:1e3e05a5-1c66-5d5e-910f-1fdd9d33cea5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-69243", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:76d2f7e3-94c8-5ccc-96f6-642c2bf8685a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-69244", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:9cdcd83d-a405-5c95-b841-ed75e913d4c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post16+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "code_not_present" } }, { "id": "GHSA-2g87-pp6c-29x5", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:6446bca9-dbf7-5bf9-92c5-2b9aa6414dd6", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post16+tuxcare of aiohttp." } }, { "id": "GHSA-pjjw-qhg8-p2p9", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ], "bom-ref": "urn:uuid:1bc37dbb-a8e5-55d6-8ed0-c68fc177b674", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post16+tuxcare of aiohttp." } } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } ] }