-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 02 Oct 2026 08:22:14 +0200 Source: python-aiohttp Architecture: source Version: 3.8.4-1+deb12u2 Distribution: bookworm-security Urgency: medium Maintainer: Debian Python Team <team+python@tracker.debian.org> Changed-By: Daniel Leidert <dleidert@debian.org> Closes: 1138780 1138781 1143160 1143597 Changes: python-aiohttp (3.8.4-1+deb12u2) bookworm-security; urgency=medium . * Non-maintainer upload by the Debian LTS team. * Enable upstream tests via autopkgtest and recreate aiohttp/_http_parser.c and aiohttp/_http_writer.c to actually apply the code-changes made to the source files. Also, replace re_assert by re in tests. Add python3-trustme to autopkgtest depends to run TLS tests. * d/patches/CVE-2023-47627.patch: Disable C parser tests which won't work with llhttp. Fix a bug in the patch checking chunk sizes. * d/patches/CVE-2024-52304.patch: Fix a bug in the patch. * d/patches/CVE-2025-53643.patch: Add patch to fix CVE-2025-53643. - Fix a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. * d/patches/CVE-2025-69223.patch: Add patch to fix CVE-2025-69223. - Fix a possible zip bomb attack against the AIOHTTP server. * d/patches/CVE-2025-69224.patch: Add patch to fix CVE-2025-69224. - Prevent a request smuggling attack with the presence of non-ASCII characters. * d/patches/CVE-2025-69225.patch: Add patch to fix CVE-2025-69225. - Don't allow non-ASCII decimals to be present in the Range header. * d/patches/CVE-2025-69226.patch: Add patch to fix CVE-2025-69226. - Fix a path traversal vulnerability that allows an attacker to ascertain the existence of path components. * d/patches/CVE-2025-69227.patch: Add patch to fix CVE-2025-69227. - Fix a possible DoS attack. When processing a POST body, an infinite loop can occur when assert statements are bypassed. * d/patches/CVE-2025-69228.patch: Add patch to fix CVE-2025-69228. - Fix a possible DoS attack that can freeze the server by exhausting the memory using Request.post(). * d/patches/CVE-2025-69229-1.patch, d/patches/CVE-2025-69229-2.patch: Add patches to fix CVE-2025-69229. - Fix the handling of chunked messages that can result in an excessive blocking of CPU usage when receiving a large number of chunks. * d/patches/CVE-2026-22815.patch: Add patch to fix CVE-2026-22815. - Fix an uncapped memory usage due to insufficient restrictions in header and trailer handling. * d/patches/CVE-2026-34513.patch: Add patch to fix CVE-2026-34513. - Fix an excessive memory usage possibly resulting in a DoS due to an unbounded DNS cache. * d/patches/CVE-2026-34514.patch: Add patch to fix CVE-2026-34514. - Fix a header injection. * d/patches/CVE-2026-34516.patch: Add patch to fix CVE-2026-34516. - Fix a potential DoS vulnerability caused by a response with an excessive number of multipart headers. * d/patches/CVE-2026-34517.patch: Add patch to fix CVE-2026-34517. - Fix a possible excessive memory usage caused by some multipart form fields due to reading the entire field into memory before checking client_max_size. * d/patches/CVE-2026-34518.patch: Add patch to fix CVE-2026-34518. - Fix leaking sensitive information by dropping the Cookie and the Proxy-Authorization headers when following redirects to a different origin. * d/patches/CVE-2026-34519.patch: Add patch to fix CVE-2026-34519. - Fix a header injection via the reason parameter. * d/patches/CVE-2026-34520.patch: Add patch to fix CVE-2026-34520. - Fix a possible security bypass by checking header values for control characters accordingly to RFC 9110. * d/patches/CVE-2026-34525-1.patch, d/patches/CVE-2026-34525-2.patch: Add patches to fix CVE-2026-34525. - Disallow duplicate headers, like host headers, except for in lax mode. * d/patches/CVE-2026-34993.patch: Add patch to fix CVE-2026-34993. - Fix an arbitrary code execution vulnerability when using CookieJar.load() with untrusted input (closes: #1138781). * d/patches/CVE-2026-47265.patch: Add patch to fix CVE-2026-47265. - Fix a possible data leak (closes: #1138780). * d/patches/CVE-2026-50269.patch: Add patch to fix CVE-2026-50269. - Fix a possible header injection. An attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. * d/patches/CVE-2026-54274.patch: Add patch to fix CVE-2026-54274. - Fix an issue where an attacker sends large incomplete websocket frame payloads and bypasses the usual size limits on memory use. * d/patches/CVE-2026-54277.patch: Add patch to fix CVE-2026-54277. - Fix an issue where an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. * d/patches/CVE-2026-54279.patch: Add patch to fix CVE-2026-54279. - Fix an issue where host-only cookies that are saved with CookieJar.save() and then later restored with CookieJar.load() lose their host-only status. * d/patches/CVE-2026-54280.patch: Add patch to fix CVE-2026-54280. - Fix a possible resource starvation caused when payload resources are not closed correctly when a client disconnects in the middle of a write. * d/patches/CVE-2026-59881.patch: Add patch to fix CVE-2026-59881. - The WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption (closes: #1143160). * d/patches/CVE-2026-69243.patch: Add patch to fix CVE-2026-69243. - The HTTP parsers are vulnerable to a request smuggling attack relating to WebSocket upgrades (closes: #1143597). Checksums-Sha1: 6535d1b8c32211f680568589d7146fd54590f1f7 2713 python-aiohttp_3.8.4-1+deb12u2.dsc 09487833fdd1661f2e34227976516ec33838fd09 7338512 python-aiohttp_3.8.4.orig.tar.gz b11e91eab0c3d29781793a72029d2663adbefa25 58512 python-aiohttp_3.8.4-1+deb12u2.debian.tar.xz 565f497f1985d647159a493819500d826ad0f3f5 8387 python-aiohttp_3.8.4-1+deb12u2_source.buildinfo Checksums-Sha256: 45752e940a4a709f0cd3bc09d51bb998c20950a5cdcdd7b713a64cdd20880b8e 2713 python-aiohttp_3.8.4-1+deb12u2.dsc bf2e1a9162c1e441bf805a1fd166e249d574ca04e03b34f97e2928769e91ab5c 7338512 python-aiohttp_3.8.4.orig.tar.gz 343f418e0560e37d86222cb415bcb7513e9689546096e5f89e09793054ffc890 58512 python-aiohttp_3.8.4-1+deb12u2.debian.tar.xz 0ae618c70387e4fccdbacfe297b41df05787b87babe73dded73d0e78b8d1de5f 8387 python-aiohttp_3.8.4-1+deb12u2_source.buildinfo Files: 8c2b26cfc8a91737fbb377c2e311de99 2713 python optional python-aiohttp_3.8.4-1+deb12u2.dsc 8208bc4b519ac4520720577f93561855 7338512 python optional python-aiohttp_3.8.4.orig.tar.gz f15aedbc37db4c256f035e6117c30fab 58512 python optional python-aiohttp_3.8.4-1+deb12u2.debian.tar.xz 76c4e01522822270bbf44792841ee938 8387 python optional python-aiohttp_3.8.4-1+deb12u2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmrmX9sACgkQS80FZ8KW 0F0SthAAxM0t1B1ETpfkJnS9vW6Zf60AWaEoZ55i4nx6ZfDCMB2rXbqnL315UBr9 dP6hOqouD3QJ8cge4l9iwxMjuMy0ecspCuxzREVTXgK70zQggbW7taK0niswPb+B xSAMLC8TSz1LUkJf4S5y9McC8KXkikODmAgfU4pGq+vgMg7/BECHvjsMO3meitgE yYdEH2rj/vExA1MfdkkqtjsFsOpNV4MzwnJThLUPTl1vpTB0suMdyo5+4/H8gH9p RWJVIrx2W4cH3GgwXQ5duG6MOfpRcHIODvZvseTVIaTHT1R5l8fDPkILbjq6zm/w uQP4yIWYoyWo3eINxc/hR7mKzIMfukU2dR3F4vR7y0SdKZhOJTmR+iaJbBhm7+KZ 8cgF9y73CkThqONdWHPW+j6GxRR/anzVdC1auPPV3r3CMcQfKeiUGMCU3BzdsnIy 95RKFlMDxR33etc2VXKka5r8vZPZhExn2DrD30sewAZg8e8kCcD0fiWaQ2rJyD/D LZSoeTdX0XlBwmZD5C1ty+/X2BFOSQMxzvSV1H3Pe70xybLZuhn2pi+WuE7pSLaZ YQ1e1m8DUcRdNvYqEt35Rgl0ZgPG6++IaJOggcEEEdeqyM8lxL0ZchhRqjZhwe1Q CH3BI53SLjGoTKBIXY76vr1/DogjDDWng2uHdmHPhPorpcbcqAU= =0oho -----END PGP SIGNATURE-----
