{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b51e914d-9493-564d-b0fd-01f3148dbd99", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "type": "library", "name": "aiohttp", "version": "3.8.6.post4+tuxcare", "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7f444583-6a24-5ea3-95a2-5fdbc34b7158", "id": "CVE-2023-49081", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-49081 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:f97cc248-90bd-5356-81e0-d9173557c5e7", "id": "CVE-2023-49082", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:2e32eed8-a928-5833-a003-b721209add39", "id": "CVE-2024-23334", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23334 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:eb2cba2c-5154-5dc9-98f1-06f60e377d78", "id": "CVE-2024-23829", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23829 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:a97c0449-678c-5b68-8d0d-bc5a8eed7d62", "id": "CVE-2024-27306", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-27306 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:3258bbfa-f644-544e-a52f-03a3058b5e4f", "id": "CVE-2024-30251", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:87bfbbb3-8fe3-5573-bac6-a244299084bc", "id": "CVE-2024-52304", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52304 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:ceb62b70-9220-52fc-9ab0-0b3ee8a45d74", "id": "CVE-2025-53643", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53643 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:803750ad-1523-5f00-91dc-52b4cd954caa", "id": "CVE-2025-69223", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69223 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:34a35702-9981-52a9-95cd-616a1b7d9ab8", "id": "CVE-2025-69224", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69224 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:d61ba558-8007-5a23-841c-0097d528dab2", "id": "CVE-2025-69225", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69225 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:d7316941-b600-5147-8361-e4ca8a7ea9f9", "id": "CVE-2025-69226", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69226 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:d746c110-7a8b-5d84-8ecb-0aa7e91cda2a", "id": "CVE-2025-69227", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69227 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:a6d6052f-b58d-5767-93f7-bc99b647ed74", "id": "CVE-2025-69228", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69228 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:63baa90e-648e-52f3-9395-ffb1703e5009", "id": "CVE-2025-69229", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69229 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:7718d283-f419-5f7d-b07c-77e205ce647d", "id": "CVE-2025-69230", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69230 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:896118f5-7120-5db6-8e89-705517b8508d", "id": "CVE-2026-22815", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:eccc6b62-aa71-5405-a86d-fe783216bf1b", "id": "CVE-2026-34513", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:bbe44a37-0529-59d0-b7e6-5a51de9f3441", "id": "CVE-2026-34514", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34514 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:b15093cc-90ab-53e0-a13a-27a797c0a77f", "id": "CVE-2026-34515", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34515 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:e8d2f25e-00e3-5108-85d0-8271d08fd1b0", "id": "CVE-2026-34516", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:20459496-e0e7-5452-8087-dfdf45704530", "id": "CVE-2026-34517", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:754e2e4c-0a02-51fe-8646-0cd61805f6c7", "id": "CVE-2026-34518", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34518 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:dabd228a-cc36-543f-95d4-4feae550a2c4", "id": "CVE-2026-34519", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:d618b0af-5032-57ea-8c30-8b762850b6c7", "id": "CVE-2026-34520", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:5ff2663d-8e4d-5a99-b313-e3e62e2937ba", "id": "CVE-2026-34525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:af411995-4821-5a41-9468-a0e9d8e69971", "id": "CVE-2026-34993", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34993 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:5392b600-3479-5503-b10a-431ac5054c34", "id": "CVE-2026-47265", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47265 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:2ed85e70-f04a-549e-b596-24756aee93f9", "id": "CVE-2026-50269", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50269 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:b6a9dee3-5d08-527c-af60-faea39048d40", "id": "CVE-2026-54273", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54273 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:9f1cf95c-669c-5f60-823c-b621cbe1a58b", "id": "CVE-2026-54274", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54274 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:f00d033f-1381-5827-8119-b0dac81420be", "id": "CVE-2026-54275", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post4+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:f64cf2cd-34d2-58f3-875e-0d1f5a12b712", "id": "CVE-2026-54276", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post4+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:9c85f626-414e-58ba-aa86-7b36dc468e2d", "id": "CVE-2026-54277", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54277 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:f4f58d80-e955-59f7-8f1e-c314c8fc6ff2", "id": "CVE-2026-54278", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54278 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:5596fbee-60c3-5847-9351-0d2d5f3b7752", "id": "CVE-2026-54279", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54279 affects version 3.8.6.post4+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }, { "bom-ref": "urn:uuid:f460987f-6f1f-5331-82f2-81254299efab", "id": "CVE-2026-54280", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post4+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } ] }