{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:235c15aa-7b7d-5558-9260-17c9377edce6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "type": "library", "bom-ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "version": "3.8.6.post16+tuxcare", "pedigree": { "ancestors": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6", "type": "library", "version": "3.8.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-49081", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:6eeea42d-ee23-5a86-b31a-e50022286d68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2023-49082", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:bccd839c-72a3-5fd2-b910-57ba3766f468", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2024-23334", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:d7558c10-9e34-51cf-a5d6-9149531dc58a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2024-23829", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:b6069e5c-7348-5376-8bd8-d398f1731dc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2024-27306", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:05321e21-64c2-53be-b694-d271f7e45660", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2024-30251", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:1cc4c08d-27e4-5e93-9326-4058c396f43d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2024-52304", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:f180dfcc-ca6d-59d1-a063-0ee16d128d92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-53643", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:0bdffea9-b59f-591e-87af-28c4059fbd05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69223", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:2ed8d492-a1b1-53db-b65b-843cad47475c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69224", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:dd9b78b9-eda7-53d0-945f-ff58d6b04c59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69225", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:03760ec2-3635-5824-b74d-33d78cb1f036", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69226", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:60909899-5b7f-5af2-ba0a-2162f01482fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69227", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:2f0c7095-d8a2-51e2-bcea-8ce4a0c2470a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69228", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:741959dd-ee9b-5fd2-942d-75a4db8f0190", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69229", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:8622543b-b161-593c-b939-82e677f3ff5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2025-69230", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:968122c7-1211-518f-b4b6-47e22767f0bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post16+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "code_not_present" } }, { "id": "CVE-2026-111063", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:cf5535fe-4a5f-5170-b8ac-de125af15ae2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111063 affects version 3.8.6.post16+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." } }, { "id": "CVE-2026-111064", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:2915e888-8f24-58b8-a569-84f2805752e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111064 affects version 3.8.6.post16+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." } }, { "id": "CVE-2026-111065", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:98a52a6b-9f8f-5dae-a930-f14cce04b87e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111065 affects version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-111066", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:9eb95337-6009-579f-97eb-78f1e21e5722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111066 affects version 3.8.6.post16+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." } }, { "id": "CVE-2026-111748", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:8f2a5f05-3f11-515e-a205-80989a08bd6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111748 affects version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-111749", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:dcf8b819-64bf-5eba-a871-e5625b4b4d52", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post16+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-111750", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:3c7084a1-8912-5c56-b495-2fbb39a02789", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111750 affects version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-22815", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:9854ae8e-e4af-5192-8119-4658bdf19ec9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34513", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:c549754b-2c8b-5fbf-8c08-419268acb143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34514", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:9aa2da5d-2a3f-5307-8249-3d721658a255", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34515", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:4385b01f-cedf-5d7a-91c0-51181870462a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34516", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:3744671a-e3e1-5095-9de8-87d199bdbac3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34517", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:79b1bfa5-97a9-5626-b61e-8dd6bd8392cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34518", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:39d5e0de-5802-5e5c-9d69-0abb9daa0429", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34519", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:048785f2-0770-5357-98cb-60be6afa5242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34520", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:9f14693d-0809-5cbe-bbf3-383227214406", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34525", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:50ac15c5-a697-57be-9315-15b4e568b96c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-34993", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:3e240aef-5f7d-5cec-a2a2-886613e40827", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-47265", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:28d5ec73-70a6-57e6-a66e-c25fa293acc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-50269", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:d0c67470-62dc-5861-ae9d-d94cbc194f40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54273", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:bd26d6dd-c189-5fe6-b72d-8e06e25556b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54274", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:3643f4e6-85c4-55ef-9b3f-b60a6b8ffddc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54275", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:c505ef52-5a3d-5fa8-af1b-e10f9d63bb00", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post16+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:305eb96a-d06f-5cc2-85f6-31390165c30c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post16+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-54277", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:e62763ed-1d5c-5320-a457-9e186e115055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54278", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:6e1e3c3c-7067-5e09-9799-07a2004eb04d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54279", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:fb8b9e89-0cce-5d4e-8b7a-f44f880b1c2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-54280", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:a6220371-4fee-53af-9dd4-7adb76e0fc32", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post16+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "code_not_present" } }, { "id": "CVE-2026-59881", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:df11622a-7515-5c89-8cbf-1cc530276b46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-69243", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:4d0b0481-b7f1-5733-8e85-d6a4c288a15e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "CVE-2026-69244", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:14a5c4d7-f917-533b-89c0-ed083cb23a88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post16+tuxcare of aiohttp." } }, { "id": "GHSA-2g87-pp6c-29x5", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ], "bom-ref": "urn:uuid:860241b2-d616-5788-97c3-fd5a6f9430ac", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post16+tuxcare of aiohttp." } } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } ] }