Detections
Analytics
SUSE SLED15 / SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3207-1)
high Nessus Plugin ID 329280
Synopsis
The remote SUSE host is missing one or more security updates.Description
The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3207-1 advisory.This update for python-aiohttp fixes the following issues
- CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service (bsc#1261320).
- CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321).
- CVE-2026-34514: `content_type` parameter manipulation can lead to header injection (bsc#1261322).
- CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of service (bsc#1261329).
- CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service (bsc#1261331).
- CVE-2026-34518: retained `Cookie` and `Proxy-Authorization` headers when following redirects can lead to information disclosure (bsc#1261332).
- CVE-2026-34519: response `reason` parameter can be use to perform header injection (bsc#1261334).
- CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).
- CVE-2026-34525: multiple `Host` headers allow for potential security bypass in proxy servers (bsc#1261343).
- CVE-2026-34993: loading untrusted input in `CookieJar.load()` can lead to arbitrary code execution (bsc#1267471).
- CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross- origin redirect and can leak sensitive data (bsc#1267561).
- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers (bsc#1268398).
- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption (bsc#1268543).
- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive resource consumption (bsc#1268544).
- CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549).
- CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource consumption (bsc#1268556).
- CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS (bsc#1268559).
- CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).
- CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and can cause resource starvation (bsc#1268561).
Tenable has extracted the preceding description block directly from the SUSE security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected python311-aiohttp package.See Also
https://bugzilla.suse.com/1261320
https://bugzilla.suse.com/1261321
https://bugzilla.suse.com/1261322
https://bugzilla.suse.com/1261329
https://bugzilla.suse.com/1261331
https://bugzilla.suse.com/1261332
https://bugzilla.suse.com/1261334
https://bugzilla.suse.com/1261335
https://bugzilla.suse.com/1261343
https://bugzilla.suse.com/1267471
https://bugzilla.suse.com/1267561
https://bugzilla.suse.com/1268398
https://bugzilla.suse.com/1268543
https://bugzilla.suse.com/1268544
https://bugzilla.suse.com/1268549
https://bugzilla.suse.com/1268556
https://bugzilla.suse.com/1268559
https://bugzilla.suse.com/1268560
https://bugzilla.suse.com/1268561
https://lists.suse.com/pipermail/sle-updates/2026-July/048658.html
https://www.suse.com/security/cve/CVE-2026-22815
https://www.suse.com/security/cve/CVE-2026-34513
https://www.suse.com/security/cve/CVE-2026-34514
https://www.suse.com/security/cve/CVE-2026-34516
https://www.suse.com/security/cve/CVE-2026-34517
https://www.suse.com/security/cve/CVE-2026-34518
https://www.suse.com/security/cve/CVE-2026-34519
https://www.suse.com/security/cve/CVE-2026-34520
https://www.suse.com/security/cve/CVE-2026-34525
https://www.suse.com/security/cve/CVE-2026-34993
https://www.suse.com/security/cve/CVE-2026-47265
https://www.suse.com/security/cve/CVE-2026-50269
https://www.suse.com/security/cve/CVE-2026-54273
https://www.suse.com/security/cve/CVE-2026-54274
https://www.suse.com/security/cve/CVE-2026-54275
https://www.suse.com/security/cve/CVE-2026-54277
https://www.suse.com/security/cve/CVE-2026-54278
Plugin Details
Severity: High
ID: 329280
File Name: suse_SU-2026-3207-1.nasl
Version: 1.1
Type: Local
Agent: unix
Family: SuSE Local Security Checks
Published: 7/24/2026
Updated: 7/24/2026
Supported Sensors: Continuous Assessment, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.06
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2026-47265
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 6.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2026-54278
Vulnerability Information
CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:python311-aiohttp
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 7/23/2026
Vulnerability Publication Date: 4/1/2026
Reference Information
CVE: CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525, CVE-2026-34993, CVE-2026-47265, CVE-2026-50269, CVE-2026-54273, CVE-2026-54274, CVE-2026-54275, CVE-2026-54277, CVE-2026-54278, CVE-2026-54279, CVE-2026-54280
SuSE: SUSE-SU-2026:3207-1