{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d2a3e537-4e83-554f-8132-eda7118e9eb7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "type": "library", "bom-ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "version": "3.8.6.post17+tuxcare", "pedigree": { "ancestors": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6", "type": "library", "version": "3.8.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-49081", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:f0c5ecab-4f16-583a-ba32-6c56c64470e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2023-49082", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:94f1841c-4697-5fe7-a2b8-29843d758dfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2024-23334", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:c762c2ba-073d-587b-98fa-ab31f804dcbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2024-23829", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:c23c2eb4-3004-536e-a869-7909d306c679", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2024-27306", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:33830198-5bb4-5560-98c3-d662c1cdae46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2024-30251", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:4c0bdbd1-8cee-5cae-92c4-01c5fae477d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2024-52304", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:9640f534-2d43-5ded-b690-3cec9cd5e4a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-53643", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:69f32b68-e9ff-532d-9192-ea3834a53984", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69223", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:8be28d1c-0010-526e-bb8b-2fdcbaa603bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69224", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:a0a2e140-c49b-5f6f-a4c8-073cc77df625", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69225", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:ea3c2ff1-7010-5966-b3a7-0e3a79448337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69226", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:078ed182-950c-532b-97ac-4938cb9baec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69227", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:b45c82bc-b80f-5ee7-bfc9-2f82dd34abc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69228", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:d8f7b484-7f4b-5e66-a02b-abba8388aaa0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69229", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:485c6f55-9427-5189-ae98-1429b83b6ab2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2025-69230", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:05f7f5f9-1ef5-5773-be86-982d14bf2a3f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post17+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "code_not_present" } }, { "id": "CVE-2026-111063", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:7ae6027e-8575-5b62-9d3f-c3b529d886c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111063 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-111064", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:77fa9811-8af7-54e2-9165-ffd15db7676c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111064 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-111065", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:7f107be8-f0a6-53b2-91eb-893fb37965e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111065 affects version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-111066", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:5032e926-0883-506b-85ab-c52f33176166", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111066 affects version 3.8.6.post17+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." } }, { "id": "CVE-2026-111748", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:48e4db62-3626-526e-9337-411cf1651c39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111748 affects version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-111749", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:bed963fa-9f03-5c3d-9c88-67480694153a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post17+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-111750", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:06a2d0a3-66b7-598b-a4f1-d02f33262ff4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111750 affects version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-22815", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:aec99f6e-fd1b-5e66-9e2a-c0a4ab38009e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34513", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:b250f3e3-b807-562f-b6c9-f3a690fd70c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34514", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:6cf00aae-0879-5a40-883d-06bfe600787d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34515", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:a19e38ea-a8ec-5b2c-8fcc-c19e755c2d73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34516", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:2da40659-90e1-50cd-8a53-9428995d3ac2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34517", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:b84498d8-32c8-5c6b-8486-141faa544512", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34518", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:a8b9ad29-66c3-53ad-a93e-cd4b1363c993", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34519", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:da7a3527-32c8-5320-a644-93f932f5d6f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34520", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:9662dba7-8ca7-56dd-8dc1-4c95e76b0a42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34525", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:049ad801-8bc4-5e73-9e3d-c9bfc77ac44d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-34993", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:cd55bdb2-2083-5035-9687-220fd52740ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-47265", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:a56c9c85-9fa3-5bf8-b908-82949bee823e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-50269", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:7c776e18-2f0f-5690-886f-21812bdbc3ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54273", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:9917213d-f0c1-5ce9-b8a0-ed500427694b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54274", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:5d21209e-92dc-543c-9a42-2c66d0f93f6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54275", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:87093704-9424-5ac0-a9a5-990fb9c10fa5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post17+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:b51ea330-278d-583a-93e9-dc6178dce4f2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post17+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-54277", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:eb146afa-9bcd-545d-8e1a-688654598992", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54278", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:d79cd533-29ac-58f9-85ba-83a4b8ef12ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54279", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:129c98b3-b11d-5be9-a9b4-937afcc10524", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-54280", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:8897df2d-52ec-594d-a0ac-832d765c1617", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post17+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "code_not_present" } }, { "id": "CVE-2026-59881", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:1a564d3a-301b-5f1a-b0f5-6789b13fe78b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-69243", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:fc753bfa-b837-5b8b-bc95-ee2d9de5af18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "CVE-2026-69244", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:3620a377-df9e-5a1d-b792-96b879427a1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post17+tuxcare of aiohttp." } }, { "id": "GHSA-2g87-pp6c-29x5", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ], "bom-ref": "urn:uuid:ff3b01d2-ea97-509a-bebf-46a121ba76f7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post17+tuxcare of aiohttp." } } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } ] }