{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9c2dcd61-3c33-5315-8a6e-4ea994e0df48", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "type": "library", "name": "aiohttp", "version": "3.8.6.post7+tuxcare", "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:475f72ec-38d6-5dd0-9159-e82039b280d7", "id": "CVE-2023-49081", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-49081 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:d9d3074f-7be8-556f-8e86-2db35eaa7b1e", "id": "CVE-2023-49082", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:e8e95039-bcd9-5e5e-acfb-6f0af5308aa8", "id": "CVE-2024-23334", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23334 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:144af424-c9a3-594f-8bae-76cf1244bfc5", "id": "CVE-2024-23829", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23829 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:ecd924da-8ae5-54ab-902e-92fd6dd5d9ab", "id": "CVE-2024-27306", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-27306 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:b015e001-f2ab-5ca8-a54f-0ef8f580e18c", "id": "CVE-2024-30251", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:7cb0513c-08d4-556a-a84c-abdb3d9ff816", "id": "CVE-2024-52304", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52304 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:fddc2254-7705-5e07-9bc7-e4f9bb79b081", "id": "CVE-2025-53643", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53643 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:0b777980-487f-52cc-8f5e-9420b793f804", "id": "CVE-2025-69223", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69223 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:1093b9ca-58f2-547a-b4ef-908875ef1b52", "id": "CVE-2025-69224", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69224 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:87f73ace-5977-5242-bb88-b3f82ce273f6", "id": "CVE-2025-69225", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69225 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:3523c9f1-47b0-52f4-b09f-838e81bd3c89", "id": "CVE-2025-69226", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69226 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:e057fd1f-02c5-5804-b3b0-2af12af8571b", "id": "CVE-2025-69227", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69227 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:39a5ad25-12d7-5c3e-ab44-93365f8f2a8e", "id": "CVE-2025-69228", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69228 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:7662d144-f638-503f-99a2-97a3f7974fe2", "id": "CVE-2025-69229", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69229 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:475854c5-f4d4-5991-9357-d8eba475f457", "id": "CVE-2025-69230", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69230 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:71fd7f23-8d7a-5b75-995b-e5836d0d987b", "id": "CVE-2026-22815", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:0488abf1-b838-59fc-9881-5e1bdcc480cd", "id": "CVE-2026-34513", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:86e501f5-0e74-58eb-bac0-f6db666232af", "id": "CVE-2026-34514", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:0d5c1062-6327-5f62-8489-6197c742dba3", "id": "CVE-2026-34515", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34515 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:b940e491-f417-5e50-abbe-8eee1cc6e628", "id": "CVE-2026-34516", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:6009b5db-e3b5-5c99-8bcf-27e6581dd0da", "id": "CVE-2026-34517", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:51d7920b-0355-5144-9236-2be9206ab061", "id": "CVE-2026-34518", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:5fc2d593-1d97-572c-a60a-39c9152ca9ff", "id": "CVE-2026-34519", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:e3efa2f1-c355-5e9c-9948-98bd5413f6ee", "id": "CVE-2026-34520", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:3ee746b9-a428-5575-8121-c47dc39121bc", "id": "CVE-2026-34525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:1ed34eb4-6356-59ea-a130-6d2170b691e2", "id": "CVE-2026-34993", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34993 affects version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:f24e5d75-dcba-5701-8d6e-b0820e19cb48", "id": "CVE-2026-47265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:67785b80-cae7-5e59-baa8-11e1ecfe5033", "id": "CVE-2026-50269", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:a74268c5-b8c1-5f65-a743-c6444e06d4df", "id": "CVE-2026-54273", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:5c331335-e413-5fe5-8fac-011d64af7dc7", "id": "CVE-2026-54274", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:a0d1abd9-181c-56c6-9ec2-d5fa1de251f7", "id": "CVE-2026-54275", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post7+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:c0215b1a-bcb5-547f-a8c4-a5ae0656e0df", "id": "CVE-2026-54276", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post7+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:9860db0e-4935-54db-9ec6-71be876f4502", "id": "CVE-2026-54277", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:e2815077-c6e7-5720-91c9-d2de48dfa9ae", "id": "CVE-2026-54278", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:89722a04-00b5-5934-9549-fa5457fd3ca3", "id": "CVE-2026-54279", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post7+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }, { "bom-ref": "urn:uuid:73185fd9-ab04-52cd-8b99-8944ab2a2bd8", "id": "CVE-2026-54280", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post7+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } ] }