{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:76f792bb-1203-5413-acd3-d4e3b7adacb0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "type": "library", "bom-ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "version": "3.8.1.post18+tuxcare", "pedigree": { "ancestors": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.1", "type": "library", "version": "3.8.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-33124", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:4f22880d-9aed-5330-9168-7253ca0db48b", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post18+tuxcare." } }, { "id": "CVE-2023-37276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:ecf2c180-4499-5b45-8848-93327a8cd3d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2023-47627", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:f3789bef-7944-53ba-a262-ce41e30897e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2023-49081", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:ad19a074-a350-54a9-badb-762f55de8617", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2023-49082", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:40bfd0a2-91d5-5bc3-b569-dd1df06c40e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2024-23334", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:81aee495-56d2-5416-9b81-4bf36cd862d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2024-23829", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:7fc5bc1b-c7cf-5d39-b8f4-8ccd7cf7eb2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2024-27306", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:8ffb2d93-e8b9-522f-9fd4-a31e1a9693a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2024-30251", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:03222011-7931-599d-8eec-fdde180748c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2024-52304", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:794b8b4e-be5a-5116-be5b-c60b0712c7e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-53643", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:688ae909-d560-5c6a-abfb-1d51c3c39ee4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69223", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:22f452c7-784b-5ff8-9de2-566507121279", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69224", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:fc28d681-f895-5166-a06a-07ac67aa0fe8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69225", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:94f4ff40-5b49-550d-91ff-1873ae044a0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69226", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:4f752d8f-dd52-5d92-8f1c-9f60751755d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69226 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69227", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:e39fd019-d9be-53dd-8984-ece6e27d4c5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69228", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:124c3a49-07b4-5aa7-8415-31f355e9b3f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69229", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:2c04578f-aefe-556e-bf4c-8cedc26ec8a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69230", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:3bd9d6f1-2d7d-5223-b523-8803fb87ef1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69230 affects version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-111063", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:2914a132-f023-5a7c-97bd-5b0c36102751", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111063 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-111064", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:923a0758-742d-5b10-899c-bf95d6fb5c42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111064 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-111065", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:a6340f64-f8fa-5148-9c2d-6256998a476b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111065 affects version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-111066", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:abbb2de6-4f36-533d-9efd-69f83cf0ba4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111066 affects version 3.8.1.post18+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." } }, { "id": "CVE-2026-111748", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:5509fbc2-d5eb-5fa7-a1cb-b4ce78d84bb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111748 affects version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-111749", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:5d201b48-4c85-588e-a0b9-4da258da12e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111749 affects version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-111750", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:788547f1-bd03-5184-83a3-6f531d84a7f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111750 affects version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-22815", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:5e8f4427-50ab-540d-8374-d8e1196acc54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34513", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:a2d55b35-e492-5a72-b168-13511945c199", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34514", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:effe342e-fc73-586b-a762-bb6edf1cb9f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34515", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:35997ab9-38d7-5af1-a699-b1cb13312e5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34515 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34516", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:a254744a-e08a-5f40-8d90-7d2d151283b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34517", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:289f983c-f337-514a-9903-cab415dabc05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34518", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:6c815b39-b721-5024-9ba7-614c46b1b1a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34519", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:2731e02d-aea9-54da-9800-31367178dd03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34520", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:8b14b4dc-d005-57c4-8e31-c96751ee1b0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34525", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:2f4e32a9-6132-56ce-aaaf-82bed0337bb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34993", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:5ffc3df5-de0b-521f-a5d4-4d2a7efeb0db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34993 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-47265", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:43c3d6bb-8e55-546b-8794-30294a782314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-50269", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:57f5da01-630d-5335-88a6-48e13783c0df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54273", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:f9895938-fc81-5534-a02e-97a7f97cd9a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54274", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:0eb6b1e8-9f30-5cad-b7f8-2091379cb038", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54275", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:e1afbcf8-3a2d-5763-b47b-be3e0243ba9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post18+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-54276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:d72f53a2-7ecc-5c27-aeb8-d7e32e8203b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post18+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54277", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:7fcdbc5e-c41d-5184-b089-e74b1fe97666", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54278", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:a876cc68-c2f4-517f-b9c1-13b2525ca7e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54278 affects version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54279", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:25c489f8-48de-5ac3-9951-7ff7f10f0d9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54280", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:a8d63f35-f536-5cc0-b531-98f1f4a97851", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post18+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "code_not_present" } }, { "id": "CVE-2026-59881", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:6208951a-4a34-5ee2-a281-6697de6c581f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-69243", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:f7614351-bb20-5e66-a49b-c629efe085b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-69244", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:00706ab2-ed02-5fd5-88dd-630426d8924a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post18+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "code_not_present" } }, { "id": "GHSA-2g87-pp6c-29x5", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:d9ceaba5-c4a6-5020-aef1-ac6ec6bac086", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post18+tuxcare of aiohttp." } }, { "id": "GHSA-pjjw-qhg8-p2p9", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ], "bom-ref": "urn:uuid:29489ead-13ed-598a-aa00-697ab3ac6318", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post18+tuxcare of aiohttp." } } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } ] }