{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8462eedc-cc63-53a3-9cd6-a533bf1e8444", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "type": "library", "bom-ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "version": "3.8.1.post17+tuxcare", "pedigree": { "ancestors": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.1", "type": "library", "version": "3.8.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-33124", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:1b5046ec-2086-5c73-9f53-6e5444ca2779", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post17+tuxcare." } }, { "id": "CVE-2023-37276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:dbd51569-cf07-58e4-b842-3803460725cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2023-47627", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:19a8af34-d173-5781-afd2-8297bd059ba6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2023-49081", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:0ddfacc8-d524-5c9a-ada0-e0350a5570e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2023-49082", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:9213321c-379d-58ad-b2cf-5b1ab41715a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2024-23334", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:9f4b1112-8db3-55a9-b9e3-55c1a68d32fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2024-23829", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:32fbdde9-79b6-540c-b30c-fa456bb919f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2024-27306", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:b936fb5f-58f3-5955-8405-2f033c0ab1fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2024-30251", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:afa492fe-29b9-593d-9448-d8bae0588587", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2024-52304", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:b7e4f0b1-2e5b-58b7-83a7-7e86271daa6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-53643", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:f8d08335-4a6c-5833-a74b-29595120b2be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69223", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:c5818d0d-2da6-59c9-94aa-638a6b5a920b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69224", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:ed9938ed-bac3-5993-8fb1-69ac79dc29e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69225", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:e411936a-6b4a-53c2-b9f9-14b4c20b5b1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69226", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:39784622-aeb3-5620-808d-8f1733afbf9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69226 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69227", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:0b4a2135-2746-52ad-addd-fcce20107e6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69228", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:b1799c0e-5597-558f-bc22-552e8cc41434", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69229", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:7540d0c0-9940-51fd-8f05-a757ac1859f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69230", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:3485409c-db39-5a36-9c0a-bf21a9f13ed1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69230 affects version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-111063", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:87b8e569-8556-52e2-9935-c40bc4b2856e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111063 affects version 3.8.1.post17+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." } }, { "id": "CVE-2026-111064", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:be54ff88-ebeb-54e1-a0de-ac285385dd5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111064 affects version 3.8.1.post17+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." } }, { "id": "CVE-2026-111065", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:e213b616-3296-5c14-ae87-89bb708c0677", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111065 affects version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-111066", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:24be9cd3-e58b-51b2-9700-43d6b6299d46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111066 affects version 3.8.1.post17+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." } }, { "id": "CVE-2026-111748", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:981381bb-dcf0-5ae5-9617-910539345777", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111748 affects version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-111749", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:ea8d0c35-814c-5bc7-ba0d-cd3c034e7096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111749 affects version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-111750", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:a19d5346-faac-55fc-b72e-d07cca1e59c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111750 affects version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-22815", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:b92fd557-1f08-5625-ac27-9557c863832d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34513", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:630c0934-147c-523a-a95e-aefe51c06bee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34514", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:07712dea-688d-5a77-9232-62c6169a3576", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34515", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:ac895255-7df9-5c63-b237-b8a47fff3186", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34515 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34516", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:22a4184f-98ce-576b-bef0-3f1d200c905d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34517", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:e8bbffda-2de5-5a4e-a112-b7441e6f7dd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34518", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:9192b282-905a-5245-a1ca-09b4e6b3f801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34519", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:8efb3b05-4402-51b4-9fc5-a8773f514581", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34520", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:99b28d9e-472f-5ad6-9123-696fde4185e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34525", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:099066eb-724d-50a2-b765-1da8778196c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34993", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:f4ec4d8b-94ce-5824-b9a7-4c6f59a9c291", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34993 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-47265", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:a110c5b2-36c2-56c2-9799-4d3ef67864f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-50269", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:2ac23506-639f-5793-8933-c8a7d431cca3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54273", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:8305e048-c8ab-57f0-b0ed-363e9ad38020", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54274", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:5cf356a8-5db1-5679-9ebf-e7d4b426734c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54275", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:1a2be624-e359-50eb-9b6c-20de7e54ecbe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post17+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-54276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:d4330eda-777e-52f8-bb44-69d2ec7e1236", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post17+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54277", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:83242061-1b58-5396-95fa-5114595ce887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54278", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:6ef2c03a-7bf1-5285-b52f-3550616bb3ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54278 affects version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54279", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:ed11165d-d055-5fb6-a67a-8b7833a65629", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54280", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:cd009f98-1354-50ee-975f-f27a9d22561c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post17+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "code_not_present" } }, { "id": "CVE-2026-59881", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:ad5d8610-051a-57fb-bada-2b42aba48a7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-69243", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:f7d95f74-b821-5eea-a5ed-ee75aabee8aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-69244", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:ee0a923a-5a01-5127-a7ab-1ff51840449c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post17+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "code_not_present" } }, { "id": "GHSA-2g87-pp6c-29x5", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:e82b67e0-b395-54a9-8baf-03df3c3c41d4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post17+tuxcare of aiohttp." } }, { "id": "GHSA-pjjw-qhg8-p2p9", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ], "bom-ref": "urn:uuid:ad806157-13c9-54b0-9d9f-7e9ccd63ed2d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post17+tuxcare of aiohttp." } } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } ] }