Debian dla-4876 : python-aiohttp-doc - security update

high Nessus Plugin ID 374702

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4876 advisory.

------------------------------------------------------------------------- Debian LTS Advisory DLA-4876-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert October 31, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : python-aiohttp Version : 3.8.4-1+deb12u2 CVE ID : CVE-2025-53643 CVE-2025-69223 CVE-2025-69224 CVE-2025-69225 CVE-2025-69226 CVE-2025-69227 CVE-2025-69228 CVE-2025-69229 CVE-2026-22815 CVE-2026-34513 CVE-2026-34514 CVE-2026-34516 CVE-2026-34517 CVE-2026-34518 CVE-2026-34519 CVE-2026-34520 CVE-2026-34525 CVE-2026-34993 CVE-2026-47265 CVE-2026-50269 CVE-2026-54274 CVE-2026-54277 CVE-2026-54279 CVE-2026-54280 CVE-2026-59881 CVE-2026-69243 Debian Bug : 1138780 1138781 1143160 1143597

Several vulnerabilities have been found in aiohttp, an asynchronous HTTP client/server framework for asyncio and Python.

CVE-2025-53643

Request smuggling vulnerability due to not parsing trailer sections of an HTTP request.

CVE-2025-69223

Possible zip bomb attack against the server.

CVE-2025-69224

Possible request smuggling attack in the HTTP parser with the presence of non-ASCII characters.

CVE-2025-69225

The parser logic allows non-ASCII decimals to be present in the Range header.

CVE-2025-69226

A path traversal vulnerability that allows an attacker to ascertain the existence of path components.

CVE-2025-69227

When processing a POST body, an infinite loop can occur when assert statements are bypassed, leading to a DoS.

CVE-2025-69228

Exhausting the memory using Request.post() can freeze the server and lead to a DoS.

CVE-2025-69229

The handling of chunked messages can result in an excessive blocking of CPU usage when receiving a large number of chunks.

CVE-2026-22815

An uncapped memory usage due to insufficient restrictions in header and trailer handling.

CVE-2026-34513

Excessive memory usage possibly resulting in a DoS due to an an unbounded DNS cache.

CVE-2026-34514

Header injection.

CVE-2026-34516

Potential DoS vulnerability caused by a response with an excessive number of multipart headers.

CVE-2026-34517

Possible excessive memory usage caused by some multipart form fields due to reading the entiry field into memory before checking client_max_size.

CVE-2026-34518

Leaking sensitive information by dropping the Cookie and the Proxy- Authorization headers when following redirects to a different origin.

CVE-2026-34519

Header injection via the reason parameter.

CVE-2026-34520

Possible security bypass by checking header values for control characters accordingly to RFC 9110.

CVE-2026-34525

Disallow duplicate headers, like host headers, except for in lax mode.

CVE-2026-34993

Arbitrary code execution when using CookieJar.load() with untrusted input.

CVE-2026-47265

Possible data leak.

CVE-2026-50269

An attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.

CVE-2026-54274

An attacker can send large incomplete websocket frame payloads and bypasses the usual size limits on memory use.

CVE-2026-54277

An attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to a DoS.

CVE-2026-54279

Host-only cookies saved with CookieJar.save() and then later restored with CookieJar.load() lose their host-only status.

CVE-2026-54280

Possible resource starvation caused when payload resources are not closed correctly when a client disconnects in the middle of a write.

CVE-2026-59881

The WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption.

CVE-2026-69243

The HTTP parsers are vulnerable to a request smuggling attack relating to WebSocket upgrades.

For Debian 12 bookworm, these problems have been fixed in version 3.8.4-1+deb12u2.

We recommend that you upgrade your python-aiohttp packages.

For the detailed security status of python-aiohttp please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/python-aiohttp

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
signature.asc Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the python-aiohttp-doc packages.

Plugin Details

Severity: High

ID: 374702

File Name: debian_DLA-4876.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 11/1/2026

Updated: 11/1/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

Percentile: 96.29

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-47265

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 7.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-54277

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:python-aiohttp-doc, p-cpe:/a:debian:debian_linux:python3-aiohttp

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/31/2026

Vulnerability Publication Date: 7/14/2025

Reference Information

CVE: CVE-2025-53643, CVE-2025-69223, CVE-2025-69224, CVE-2025-69225, CVE-2025-69226, CVE-2025-69227, CVE-2025-69228, CVE-2025-69229, CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525, CVE-2026-34993, CVE-2026-47265, CVE-2026-50269, CVE-2026-54274, CVE-2026-54277, CVE-2026-54279, CVE-2026-54280, CVE-2026-59881, CVE-2026-69243

Detections

Analytics

Debian dla-4876 : python-aiohttp-doc - security update

high Nessus Plugin ID 374702

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

CVSS v4

Vulnerability Information

Reference Information