{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8e433b78-8a72-5f03-9634-3ad0f96e1e37", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "type": "library", "bom-ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "version": "3.8.1.post20+tuxcare", "pedigree": { "ancestors": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.1", "type": "library", "version": "3.8.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-33124", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:faa7f4d7-6b71-5487-b4f9-051e5b0cc344", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post20+tuxcare." } }, { "id": "CVE-2023-37276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:0e1c4fcd-4de9-57fb-bece-0af666342e2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2023-47627", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:809fb63f-2646-5f38-8152-1fd2773720c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2023-49081", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:a3561b92-2c3c-5623-a605-eef06fba6c46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2023-49082", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:cee93f79-d4a4-500c-80ac-d3363fee8551", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2024-23334", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:8c41d342-9065-5b99-b55f-ed8827dbe3d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2024-23829", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:f710fe55-8659-53fb-a7d7-3252f4a0f546", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2024-27306", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:91686489-a1d0-5abd-8461-1e2330358121", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2024-30251", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:3cbf5e30-f851-53e4-87ee-1ff063ea1ef1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2024-52304", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:b0cd5d74-5374-5fd3-8f5e-d9167d3bdbc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2025-53643", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:a1669b6d-18e9-5729-ab64-476daf05ab13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2025-69223", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:8654ab9e-5ca6-57ea-973a-3d134ce36b45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2025-69224", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:5f8931c8-6605-544d-a611-65ff17ed8174", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2025-69225", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:db8678f1-8f55-58c0-9fa6-02a364195f9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2025-69226", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:5188159f-a41f-5d35-b9c9-17bf6ea3641a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69226 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2025-69227", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:81c1d7c5-89a0-5c7f-a56d-18755baee9c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2025-69228", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:b057bcca-349d-5e68-a818-77aba7632a90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2025-69229", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:54bc97ee-da80-5a75-bbaf-fe3c59368a41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2025-69230", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:ada5bf26-cf9e-5ba4-add7-7c3c0d8eecaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69230 affects version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-111063", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:45e85b1a-baf8-579b-ae50-3a5ac756912a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111063 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-111064", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:0ee5a5c4-0d5f-5c05-a9ce-ef591aabeea2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111064 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-111065", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:82e6de99-dc26-537c-b105-f8f1b5667862", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111065 affects version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-111066", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:28335d41-b043-5707-8988-94b1fba456d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111066 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-111748", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:48121750-eb10-5de7-9d29-05a40911158f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111748 affects version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-111749", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:0fb4fed7-139f-56f3-ad16-6c3c5dfdb864", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111749 affects version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-111750", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:5d18ff7e-7435-5c57-9e44-6027b6f86938", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111750 affects version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-22815", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:5a10ae5f-e4e0-50dc-a1af-8aa96258e264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-34513", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:0f332daf-f9a6-55fd-afc7-489f53c2ed08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-34514", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:bdde6e1b-8c88-5ba1-b039-fbe45bc43c0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-34515", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:2af33c77-0fbf-5a01-800b-feb4efd9e483", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34515 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-34516", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:1e6afdd1-861a-5eea-b76d-655bf1f08c9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-34517", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:16a2afa5-2028-5488-a346-64d84d7f6061", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-34518", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:7297da36-5d1e-5f3c-9a76-406359d51bf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-34519", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:ff91fff7-5cf1-5ec5-9a19-62fb37e54111", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-34520", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:bfe66db3-3f55-519f-8168-fa4daa86d0f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-34525", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:7de18c12-465e-54e2-841b-5f111eb65e33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-34993", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:611b952b-bd8c-5bbd-9932-c54e6500d647", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34993 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-47265", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:3d27871d-9131-57b7-ab8c-5beb126ce318", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-50269", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:9664105d-8af2-5df7-b6a1-bf037a94cc42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-54273", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:ddc9f966-dec7-53b9-bbc8-2857f6dbfa4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-54274", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:6e176fed-f01c-5c73-9be4-8d01097b2374", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-54275", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:4c46f299-2298-536c-89ce-cef2c2c3ccdd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post20+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-54276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:8026ced9-55b1-53cb-9759-ef8deae09d06", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post20+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54277", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:4dea28cd-75d3-5729-97f8-bc25454532ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-54278", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:896cffe2-ed00-55b8-bd12-6b70d0ad2a66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54278 affects version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-54279", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:1e13b11c-34f4-58ca-8873-4852367ead60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-54280", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:ff723b94-3680-5d74-9c1a-4f4994ef583a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post20+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "code_not_present" } }, { "id": "CVE-2026-59881", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:52e61a6c-6c05-52a6-ac84-314655d506a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-69243", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:08fcbe14-4545-547d-a790-ae7fb9532d91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "CVE-2026-69244", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:b15762ea-3cf6-5dcc-a064-6320169ce1ba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post20+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "code_not_present" } }, { "id": "GHSA-2g87-pp6c-29x5", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:5c7e5978-1c2f-5e87-b81d-8e1dfe558017", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post20+tuxcare of aiohttp." } }, { "id": "GHSA-pjjw-qhg8-p2p9", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ], "bom-ref": "urn:uuid:a9daa880-6204-5b9b-8a92-ea28de635354", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post20+tuxcare of aiohttp." } } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } ] }