Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-54278 →

DEBIAN-CVE-2026-54278

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed reques...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:13 python-aiohttp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 python-aiohttp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.1-1"}]}]

Références

advisory security-tracker.debian.org