{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4bf9b6a0-960b-579d-b48e-4e2ddad882ca", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "type": "library", "bom-ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "version": "3.8.6.post18+tuxcare", "pedigree": { "ancestors": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6", "type": "library", "version": "3.8.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-49081", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:6deef311-e9a4-50f4-850a-a6c0a772378d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2023-49082", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:a8be60e1-6b1c-5b6c-af07-2e56330fb8e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2024-23334", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:174b9a8c-06bc-563c-b80b-b373f2892314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2024-23829", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:00c7ebe6-f9f4-563d-992a-4736c7833fa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2024-27306", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:9d1e07eb-8c01-53b9-b8fb-4a66efb0fd86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2024-30251", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:6f274197-bae3-552d-861c-e74c7ca0c508", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2024-52304", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:7a10d885-e837-50fd-908b-e2c460970064", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-53643", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:0e47a217-bb6d-512e-b8fd-0b214c372f50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69223", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:b98ebd56-1721-545b-b682-91d36548eb32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69224", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:a3009b92-f1aa-59ac-ae78-f3df85a001ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69225", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:12238c5f-225d-52a1-9441-52d99637e560", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69226", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:988350e3-79db-5d17-b2c1-8cb8c6b588db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69227", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:b091f823-2d75-5d10-b72b-10767b0e3a93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69228", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:73afd6d8-b72c-5798-b33b-735bc6184f3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69229", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:7a4009a2-c004-52a3-9e42-a98cc8dbaf6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2025-69230", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:50f50aa1-069f-5e4a-b1c8-20cf8781e68c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post18+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "code_not_present" } }, { "id": "CVE-2026-111063", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:b36c8ad2-2a4b-527f-8773-b597cdba23f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111063 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-111064", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:12716a60-af6a-5ac6-b79f-281d90921662", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111064 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-111065", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:187105eb-c255-52b5-ac51-e42ef6a7f6f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111065 affects version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-111066", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:24b2587e-2263-5852-8c39-fad848b13cff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111066 affects version 3.8.6.post18+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." } }, { "id": "CVE-2026-111748", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:38716ece-4076-5e13-a226-d936760725f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111748 affects version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-111749", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:cfad48ab-ee0a-53b5-95f1-c2962794b5f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post18+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-111750", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:92e9d9b4-b8e2-543a-8d96-e77fda767690", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111750 affects version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-22815", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:758aad1f-ccbc-5527-a9dc-57c6f74e2d5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34513", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:b5d7f1d0-9934-5015-9794-f740d94768cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34514", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:d05fb385-dfe0-5a6c-b12f-912c002f73c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34515", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:d6a7653b-a751-5f9a-a22a-ac136cd387df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34516", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:a5145147-822b-5dc2-9d01-c5ac86d353ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34517", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:7337aa4a-4c15-5482-ad0d-fb81ee1f2d9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34518", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:4c87672d-8de7-569d-8de9-2a0f4f821021", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34519", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:92b1080e-cc71-52a4-9541-0e8d9a740e73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34520", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:b35fd5c1-096b-5231-a5a7-c2571931c24f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34525", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:1c8dc87c-d7dc-5c9c-a29a-4369f97f2a0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-34993", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:381ebb2d-a31c-54f6-8127-a3ff195c5e82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-47265", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:887d0624-d5c5-5b0e-8889-7d1adee6391d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-50269", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:20a9e2ab-b203-5ff6-966b-adbdb43ce982", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54273", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:a9ba18e1-5fd7-572f-b837-96f4cab4ce5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54274", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:74dd29c3-ea4e-54d2-ba3c-febbbd406282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54275", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:455c7cf3-0b66-5071-b4c3-bbc24fd37583", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post18+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:c14f4972-027a-5707-90ed-65de15e94558", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post18+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-54277", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:a8658da4-d5bc-5064-a289-59196c5f69c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54278", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:95962f33-acfc-5749-80ea-3c75e1d33d3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54279", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:5b7b89c9-f3c8-585a-b93f-cdb60a4c0d53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-54280", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:93cd6492-ecb5-5190-9ef2-8562c2cba0da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post18+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "code_not_present" } }, { "id": "CVE-2026-59881", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:0f41abb8-b026-595d-a684-47c9d16f64b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-69243", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:60061324-5c5d-5e89-abf4-4e5fb5b9e9b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "CVE-2026-69244", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:e0d4812f-821f-5c4a-9857-5355d4d97b2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post18+tuxcare of aiohttp." } }, { "id": "GHSA-2g87-pp6c-29x5", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ], "bom-ref": "urn:uuid:554071a0-d4fb-5274-bcab-8a0f4191f3c1", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post18+tuxcare of aiohttp." } } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } ] }