Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 506
Alerts This Week
Warning Icon 1 506

openSUSE Python-Aiohttp Important Resource Issues Vuln 2026-21372-1

opensuse
Calendar Grey July 21, 2026
Scroller Opensuse
This update for openSUSE fixes important issues in python-aiohttp, preventing resource overconsumption and DoS attacks.
An update that solves 8 vulnerabilities and has 8 bug fixes can now be installed.

Description

This update for python-aiohttp fixes the following issues

- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers

(bsc#1268398).

- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption

(bsc#1268543).

- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive

resource consumption (bsc#1268544).

- CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549).

- CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource

consumption (bsc#1268556).

- CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS

(bsc#1268559).

- CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).

- CVE-2026-54280: payload resources are not closed...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory DoS important resource consumption OpenSUSE python-aiohttp

Patch

Package List

- openSUSE Leap 16.0:

python313-aiohttp-3.11.16-160000.6.1

References

* bsc#1268398

* bsc#1268543

* bsc#1268544

* bsc#1268549

* bsc#1268556

* bsc#1268559

* bsc#1268560

* bsc#1268561

References:

* https://www.suse.com/security/cve/CVE-2026-50269.html

* https://www.suse.com/security/cve/CVE-2026-54273.html

* https://www.suse.com/security/cve/CVE-2026-54274.html

* https://www.suse.com/security/cve/CVE-2026-54275.html

* https://www.suse.com/security/cve/CVE-2026-54277.html

* https://www.suse.com/security/cve/CVE-2026-54278.html

* https://www.suse.com/security/cve/CVE-2026-54279.html

* https://www.suse.com/security/cve/CVE-2026-54280.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2026:21372-1
Rating: important
Affected Products: openSUSE Leap 16.0 -------------------------------------------------------------

Topics%20covered

Topics Covered

security advisory DoS important resource consumption OpenSUSE python-aiohttp

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.