{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bb5843b4-b788-549f-8672-326a764b4d58", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "type": "library", "bom-ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "version": "3.8.6.post15+tuxcare", "pedigree": { "ancestors": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6", "type": "library", "version": "3.8.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-49081", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:fd1fe64d-f3b5-5ce1-95a2-dd6150a9acee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2023-49082", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:62677276-8f13-5216-9753-42842848a6c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2024-23334", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:7ebe7b7f-dbd0-5270-a721-40e8a7f1b11a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2024-23829", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:2114109a-bb28-5fbd-a055-5cdabf27b921", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2024-27306", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:a03ca22a-984a-52bc-b384-51fad97b757f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2024-30251", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:e70a18f6-ddd5-5314-84af-e5beae52451d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2024-52304", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:8d2a8459-b420-5faf-ab6f-599f81f5c873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-53643", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:34c3e847-d766-55ad-9777-048b9a83ea1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69223", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:2becafaf-be38-58ad-aec0-8d0e697211da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69224", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:f307df21-553b-5adf-bf7d-8a2c34ac77d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69225", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:f4db5a5f-7d96-574b-9148-7545c187d78d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69226", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:4cc86abf-a43c-5469-acc7-3a37946a1c06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69227", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:cfa3bb40-302f-5a23-a6f6-6322a9243294", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69228", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:d530afea-f18b-591c-bac1-dcd663b8b586", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69229", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:9ce25d2d-29d7-51a3-84a8-c7bca89f318b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2025-69230", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:d4031634-5094-5c8b-abe9-e7154416668a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post15+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "code_not_present" } }, { "id": "CVE-2026-111063", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:cdd2d3bc-40f3-52f7-8e36-024ac883ce30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111063 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." } }, { "id": "CVE-2026-111064", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:f73754c3-15cd-5138-a5cc-844f439b9375", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111064 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." } }, { "id": "CVE-2026-111065", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:3304087b-90ee-5d6b-9f73-4ed1bc29c2c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111065 affects version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-111066", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:ded3d617-00c1-5c8c-896b-4811b2f4b250", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111066 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." } }, { "id": "CVE-2026-111748", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:2b8ab4ae-d3b5-5880-a188-f25711f95583", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111748 affects version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-111749", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:a37e2803-4279-55bf-b224-d19a0cc0faa4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-111750", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:d24eb0c4-76b1-5e11-80cb-4b2f3271be53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111750 affects version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-22815", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:27aa1022-0845-530f-9c02-660b3ff00382", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34513", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:cd495b64-1e08-5298-84ad-25e2b65a3a14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34514", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:a6b66660-5917-5062-aafb-d4a1b273bac3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34515", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:ca3ff5f8-57a3-57dd-a088-74d1ab94f268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34516", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:7f84f703-9610-560d-849c-3ab7a1ee4a05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34517", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:cdd45c37-300d-508f-82e3-a77ca4960e6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34518", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:8182f0bb-f679-5d2c-9dd2-e2ff591b5818", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34519", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:6fdcd08c-b4e3-526b-bad6-862102a58b10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34520", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:92ce7788-adad-5f5c-8472-d844ed9b0649", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34525", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:7df2ad14-07e0-54ec-bb66-22a5371bf206", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-34993", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:f21716c6-c737-5ee2-b2ec-b0ac28969fe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-47265", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:01c24881-5068-55aa-8fbb-5296ea75a022", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-50269", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:602907d8-1521-57c0-a47b-6d40a5b7e6e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54273", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:ecbe9871-7d99-5c67-aa29-71e90c8ac521", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54274", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:b55237e8-8ac3-5876-8d27-e96376c001f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54275", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:6478f230-bdc9-5540-96e4-c45922181a69", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:934918ae-a8ab-5449-9d56-6cf4cea03fd1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-54277", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:f7bf4eae-7cdb-595f-98cc-c24daa1a7a1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54278", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:1a2cad86-9f55-5979-9895-ea7a01d21a05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54279", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:421f3362-5f26-5d26-8e25-906d50ffa6de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-54280", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:864b0d14-9476-5189-b505-5841241d8327", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post15+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "code_not_present" } }, { "id": "CVE-2026-59881", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:711bffd1-eae5-54fc-86f3-28debea1450d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-69243", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:8ab53629-bd33-5703-b7c8-d2c4d7a01253", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "CVE-2026-69244", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:3321a063-1fcd-5363-8605-ff1207e88e27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post15+tuxcare of aiohttp." } }, { "id": "GHSA-2g87-pp6c-29x5", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ], "bom-ref": "urn:uuid:b6237afd-c6c0-5a12-a9cc-8e0d2d6d05c5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post15+tuxcare of aiohttp." } } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } ] }