{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f7fba51a-60ea-55c2-aaad-4699955d3298", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "type": "library", "bom-ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "version": "3.8.6.post19+tuxcare", "pedigree": { "ancestors": [ { "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.8.6", "type": "library", "version": "3.8.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-49081", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:88876512-5137-5f9e-b557-600349f60205", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2023-49082", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:5b5642c1-b096-5e86-874a-f4c0e9b45626", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2024-23334", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:558d87d7-29f6-5baf-b7ce-e874370b0c4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2024-23829", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:af7bfdb6-9ed0-52f1-a4d7-1c3182bd92fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2024-27306", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:1718bd1a-d11d-54f4-b59c-1db157736dfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2024-30251", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:abf39be5-d4b2-50ef-9dff-74af75523263", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2024-52304", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:3ce34fe3-46a8-5fa0-bfa4-3177198518b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-53643", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:dfbe170c-e4e6-5425-862e-02642078ac0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69223", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:b5421168-579f-5d75-936e-cff1f71a2b76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69224", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:b297864e-5939-5d43-96ae-3f9f4e4435bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69225", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:66e0f2ef-a2ff-550d-ba08-0d119bcecebd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69226", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:d20efdc5-7645-5c40-98b8-ff0ccb65a44a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69227", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:94e1adc2-75d7-55ef-af90-aa0e46b5950a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69228", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:e4fecba0-1714-5254-a107-465ae7ee9f42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69229", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:4120ddff-85fd-5500-b39c-c80e9fde61bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2025-69230", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:7243ffe8-72e8-5322-8185-cdf2b84982d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post19+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "code_not_present" } }, { "id": "CVE-2026-111063", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:4a0c18b7-08ae-5084-ac68-e350b5d1add1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111063 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-111064", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:79385ebd-1023-5d71-97cc-09fb23422c88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111064 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-111065", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:30fabf83-9de3-513a-bc72-ddb89edbcd2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111065 affects version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-111066", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:dd5d3eda-1690-5721-8a7b-2920fb2f8d45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111066 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-111748", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:a90822ed-3f3a-597b-9972-326b42084ce4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111748 affects version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-111749", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:ddc5556b-f947-5b6d-8704-00e16363b7ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post19+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-111750", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:0b42726f-872e-5480-a005-034ddee969bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111750 affects version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-22815", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:f95dec2a-7917-5c36-ad1d-d52bd28dae2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34513", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:d8de3848-05a6-5e68-8c4f-5b2c59c565cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34514", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:4ed3efc2-623f-5802-abf0-65419d41a2ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34515", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:31d1fa14-45f5-50e0-9063-6dae8c80600e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34516", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:f71d3221-c52a-5193-b35b-a1f349ac3638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34517", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:d1b0b29b-5186-52ab-b404-60a81a159339", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34518", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:e007a225-c48c-5969-8b41-497834a28802", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34519", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:0544ce11-ef68-5f36-a419-0d82345efed4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34520", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:8a427a7c-496e-503f-880d-19d89a9b02db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34525", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:8e48948c-2088-5eb8-a81c-82f5f2881a36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-34993", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:646ed61a-5a09-5061-96d3-40135e28b56c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-47265", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:954a8740-7760-5d2d-b2e9-d434ebc42db2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-50269", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:d094f8d7-6501-517f-a7e1-e282abcfc73a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54273", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:4ad2fc5c-35be-58f1-ac98-d7dbbc7132a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54274", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:60dafe27-de7a-5c95-a9ba-993be690c703", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54275", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:6f90f93b-1254-5ed0-a431-9b3e6aa3be3d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post19+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54276", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:aeb6476c-0dcf-50f5-b427-37ae03a7d651", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post19+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-54277", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:cb721ef3-f2db-5885-994b-6fa4617fabed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54278", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:0f43349b-8a16-5bd1-b1a8-762cea34031b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54279", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:fd1d0600-f960-5984-97f6-c3a7f3b5e6e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-54280", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:f6ecfa2e-5e2d-5cef-908d-c2b5a9f464c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post19+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "code_not_present" } }, { "id": "CVE-2026-59881", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:0b16fb11-eed0-54d9-84f5-3c13cc6955dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-69243", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:0a8f1dfb-fdda-51b3-82b9-f958c16724ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "CVE-2026-69244", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:9f256e8a-327b-5c82-ae75-d867f417f950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post19+tuxcare of aiohttp." } }, { "id": "GHSA-2g87-pp6c-29x5", "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ], "bom-ref": "urn:uuid:245898f1-1772-5b4a-9c20-6f8be0920521", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post19+tuxcare of aiohttp." } } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } ] }