Detections
Analytics
SUSE SLES16 Security Update : python-aiohttp (SUSE-SU-2026:22173-1)
high Nessus Plugin ID 323099
Synopsis
The remote SUSE host is missing one or more security updates.Description
The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22173-1 advisory.This update for python-aiohttp fixes the following issues
- CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
- CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
- CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
- CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
- CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
- CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332).
- CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
- CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
- CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
- CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
- CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross- origin redirect (bsc#1267561).
Tenable has extracted the preceding description block directly from the SUSE security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected python313-aiohttp package.See Also
https://bugzilla.suse.com/1261320
https://bugzilla.suse.com/1261321
https://bugzilla.suse.com/1261322
https://bugzilla.suse.com/1261329
https://bugzilla.suse.com/1261331
https://bugzilla.suse.com/1261332
https://bugzilla.suse.com/1261334
https://bugzilla.suse.com/1261335
https://bugzilla.suse.com/1261343
https://bugzilla.suse.com/1267471
https://bugzilla.suse.com/1267561
https://www.suse.com/security/cve/CVE-2026-22815
https://www.suse.com/security/cve/CVE-2026-34513
https://www.suse.com/security/cve/CVE-2026-34514
https://www.suse.com/security/cve/CVE-2026-34516
https://www.suse.com/security/cve/CVE-2026-34517
https://www.suse.com/security/cve/CVE-2026-34518
https://www.suse.com/security/cve/CVE-2026-34519
https://www.suse.com/security/cve/CVE-2026-34520
https://www.suse.com/security/cve/CVE-2026-34525
https://www.suse.com/security/cve/CVE-2026-34993
Plugin Details
Severity: High
ID: 323099
File Name: suse_SU-2026-22173-1.nasl
Version: 1.1
Type: Local
Agent: unix
Family: SuSE Local Security Checks
Published: 6/26/2026
Updated: 6/26/2026
Supported Sensors: Nessus Agent, Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2026-47265
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 6.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/o:novell:suse_linux:16, p-cpe:/a:novell:suse_linux:python313-aiohttp
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 6/19/2026
Vulnerability Publication Date: 4/1/2026
Reference Information
CVE: CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525, CVE-2026-34993, CVE-2026-47265
SuSE: SUSE-SU-2026:22173-1