{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:45723e29-1529-5f95-aeea-02887d9859df", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "type": "library", "bom-ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "version": "3.8.1.post19+tuxcare", "pedigree": { "ancestors": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.1", "type": "library", "version": "3.8.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-33124", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:ed7ee381-ba40-53c6-97e3-105307c09922", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post19+tuxcare." } }, { "id": "CVE-2023-37276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:d5e60f7c-4bd8-5ca3-836d-0446f60a07e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2023-47627", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:0f147c8f-7adb-5dfc-b349-432614a75355", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2023-49081", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:a9749544-5d51-5a60-adb4-6329061da8e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2023-49082", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:16a117db-5f5f-5d5c-96a3-f649673e1540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2024-23334", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:3ae73a43-b873-524a-80fa-e4cecffad919", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2024-23829", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:1ff359e2-8f1d-5d55-92f0-26e359b77606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2024-27306", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:612b8f27-96df-53d5-9039-e935891e6710", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2024-30251", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:aff5dcaa-0efe-5c2c-9bc2-ddbd53ec428c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2024-52304", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:4490aba6-76e8-5751-b0a0-89bc41290625", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-53643", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:f2f593da-2de7-59d5-bdfa-d310608b6bf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69223", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:cfb5d4ef-bc3c-523a-bb69-9850f11bace0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69224", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:0edefaf6-fb32-5c3e-a6e6-a3605aeff104", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69225", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:54d614ba-cdea-5d51-8871-03d485542b0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69226", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:ccc3210c-7693-542f-bbb8-1819649fcdb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69226 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69227", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:13fc3d80-f4a4-581b-9b39-802920d90660", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69228", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:00c1323a-aefb-59b4-9526-e5cc53a7e752", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69229", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:b2a553ed-3a67-5be5-90d8-0c62880cb410", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69230", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:fcee6a6b-71bb-5e79-9c1e-9dcf2da9f0cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69230 affects version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-111063", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:9e7d9a8a-ea90-507b-9e35-37bdf051d212", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111063 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-111064", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:028d8a28-624c-575e-a972-10d758523660", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111064 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-111065", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:27bc1c07-17c4-5562-95be-2c478fea114d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111065 affects version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-111066", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:5286f675-98e1-5477-bafb-aa3c4a4f634b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111066 affects version 3.8.1.post19+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." } }, { "id": "CVE-2026-111748", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:711d64fb-7c8b-597a-a580-fb96cc911bc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111748 affects version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-111749", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:fffa6519-b292-531e-8445-f6b81975e710", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111749 affects version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-111750", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:4959de1a-f159-50fb-ab6d-c27943278e84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111750 affects version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-22815", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:c5321d7a-7432-500f-a5b7-a2fe195fb36d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34513", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:ab03f607-cc85-5bb5-8ac1-9812e65f81aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34514", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:d4e33a16-a9b0-5c9e-b76b-eed3030f38f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34515", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:f8cc3f03-4d3c-5866-8c8f-c3eb4a456dfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34515 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34516", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:c8c83e4a-6615-5451-9de6-bd219e52ded5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34517", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:a1c45a1a-3ed4-5706-941c-a3b14cd9a6ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34518", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:6ffefda4-0e85-5d73-ae6e-12f99e8f3633", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34519", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:d47cbec6-2554-5794-afcd-41502973e4dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34520", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:7a58184c-16db-55ef-b831-4e2e45afb63f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34525", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:67273973-7e4b-5266-8075-051f67d32313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34993", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:953e2950-592c-5324-9692-125789b8df7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34993 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-47265", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:8df6f65c-6b5c-5142-9bbb-d46c69b3e313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-50269", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:e5bee744-5d25-50ef-b897-d82463df9495", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54273", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:aae1009d-d3d0-5d4d-9238-590756c6b0df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54274", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:b18c9587-4718-5e3f-90b3-d5841162a6bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54275", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:0adcaa1d-07b6-596c-8798-2f8aa646454b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post19+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-54276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:7d72d10b-31d3-5aa3-8fa3-b7a31abd4421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post19+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54277", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:4dbc4baf-2558-5f3e-ab03-60a08f3786c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54278", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:155464e8-df21-5b49-9645-428f1b25a768", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54278 affects version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54279", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:29715b0c-e734-5887-acdd-c9f3226b8504", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54280", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:3dd5180e-bf07-5a5b-b921-61c51d2dce5b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post19+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "code_not_present" } }, { "id": "CVE-2026-59881", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:cf804701-3239-5d6c-8600-189fbea392b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-69243", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:b7ceb055-aff5-5610-aad5-8fa617756552", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-69244", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:9256dc04-b004-50fe-b79e-554f8339e094", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post19+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "code_not_present" } }, { "id": "GHSA-2g87-pp6c-29x5", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:fdad2fd3-8d8c-5e2c-ae7a-3e683d6bec5b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post19+tuxcare of aiohttp." } }, { "id": "GHSA-pjjw-qhg8-p2p9", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ], "bom-ref": "urn:uuid:50f40825-1610-58b2-8ae8-f99f3fd97400", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post19+tuxcare of aiohttp." } } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } ] }