There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4,
    an attacker who controls the reason parameter when creating a Response may be able to inject extra headers
    or similar exploits. This issue has been patched in version 3.13.4. (CVE-2026-34519)

The version of aioHTTP installed on the remote host is prior to 3.13.4. It is, therefore, affected by a request smuggling vulnerability:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4,     insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has     been patched in version 3.13.4. (CVE-2026-22815)

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4,     a response with an excessive number of multipart headers may be allowed to use more memory than intended,     potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4. (CVE-2026-34516)

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4,     multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.     (CVE-2026-34525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22173-1 advisory.

    This update for python-aiohttp fixes the following issues

    - CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
    - CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
    - CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
    - CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
    - CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
    - CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information     disclosure       (bsc#1261332).
    - CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
    - CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
    - CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
    - CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
    - CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-     origin redirect       (bsc#1267561).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4,     an attacker who controls the reason parameter when creating a Response may be able to inject extra headers     or similar exploits. This issue has been patched in version 3.13.4. (CVE-2026-34519)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-604898 advisory.

    [2.187.0-1.0.5]
    - Fix multiple CVEs in pyjwt, aiohttp, pyOpenSSL, multidict

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4613 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4613-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     June 01, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-aiohttp     Version        : 3.7.4-1+deb11u2     CVE ID         : CVE-2025-53643 CVE-2025-69224 CVE-2025-69225 CVE-2025-69226                      CVE-2025-69227 CVE-2025-69228 CVE-2025-69229 CVE-2026-22815                      CVE-2026-34513 CVE-2026-34514 CVE-2026-34516 CVE-2026-34517                      CVE-2026-34518 CVE-2026-34519 CVE-2026-34520 CVE-2026-34525


    Several vulnerabilities have been found in aiohttp, an asynchronous     HTTP client/server framework for asyncio and Python.


    CVE-2025-53643

       Request smuggling vulnerability due to not parsing trailer sections        of an HTTP request.

    CVE-2025-69224

       Possible request smuggling attack in the HTTP parser with the        presence of non-ASCII characters.

    CVE-2025-69225

       Parser logic which allows non-ASCII decimals to be present in the        Range header.

    CVE-2025-69226

       Path traversal vulnerability that allows an attacker to ascertain        the existence of path components.

    CVE-2025-69227

       When processing a POST body, an infinite loop can occur when assert        statements are bypassed leading to a possible DoS attack.

    CVE-2025-69228

       Possible DoS attack that can freeze the server by exhausting the        memory using Request.post().

    CVE-2025-69229

       The handling of chunked messages that can result in an excessive        blocking of CPU usage when receiving a large number of chunks.

    CVE-2026-22815

       Uncapped memory usage due to insufficient restrictions in header and        trailer handling.

    CVE-2026-34513

       Excessive memory usage possibly resulting in a DoS due to an an        unbounded DNS cache.

    CVE-2026-34514

       Header injection.

    CVE-2026-34516

       Potential DoS vulnerability caused by a response with an excessive        number of multipart headers.

    CVE-2026-34517

       Possible excessive memory usage caused by some multipart form fields        due to reading the entiry field into memory before checking        client_max_size.

    CVE-2026-34518

       Leaking sensitive information by dropping the Cookie and the Proxy-        Authorization headers When following redirects to a different        origin.

    CVE-2026-34519

       Header injection via the reason parameter.

    CVE-2026-34520

       Possible security bypass by checking header values for control        characters accordingly to RFC 9110.

    CVE-2026-34525

       Headers can be duplicated, e.g. the host header.


    For Debian 11 bullseye, these problems have been fixed in version     3.7.4-1+deb11u2.

    We recommend that you upgrade your python-aiohttp packages.

    For the detailed security status of python-aiohttp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-aiohttp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4876 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4876-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     October 31, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-aiohttp     Version        : 3.8.4-1+deb12u2     CVE ID         : CVE-2025-53643 CVE-2025-69223 CVE-2025-69224 CVE-2025-69225                      CVE-2025-69226 CVE-2025-69227 CVE-2025-69228 CVE-2025-69229                      CVE-2026-22815 CVE-2026-34513 CVE-2026-34514 CVE-2026-34516                      CVE-2026-34517 CVE-2026-34518 CVE-2026-34519 CVE-2026-34520                      CVE-2026-34525 CVE-2026-34993 CVE-2026-47265 CVE-2026-50269                      CVE-2026-54274 CVE-2026-54277 CVE-2026-54279 CVE-2026-54280                      CVE-2026-59881 CVE-2026-69243     Debian Bug     : 1138780 1138781 1143160 1143597


    Several vulnerabilities have been found in aiohttp, an asynchronous     HTTP client/server framework for asyncio and Python.


    CVE-2025-53643

       Request smuggling vulnerability due to not parsing trailer sections        of an HTTP request.

    CVE-2025-69223

       Possible zip bomb attack against the server.

    CVE-2025-69224

       Possible request smuggling attack in the HTTP parser with the        presence of non-ASCII characters.

    CVE-2025-69225

       The parser logic allows non-ASCII decimals to be present in the        Range header.

    CVE-2025-69226

       A path traversal vulnerability that allows an attacker to ascertain        the existence of path components.

    CVE-2025-69227

       When processing a POST body, an infinite loop can occur when assert        statements are bypassed, leading to a DoS.

    CVE-2025-69228

       Exhausting the memory using Request.post() can freeze the server and        lead to a DoS.

    CVE-2025-69229

       The handling of chunked messages can result in an excessive blocking        of CPU usage when receiving a large number of chunks.

    CVE-2026-22815

       An uncapped memory usage due to insufficient restrictions in header        and trailer handling.

    CVE-2026-34513

       Excessive memory usage possibly resulting in a DoS due to an an        unbounded DNS cache.

    CVE-2026-34514

       Header injection.

    CVE-2026-34516

       Potential DoS vulnerability caused by a response with an excessive        number of multipart headers.

    CVE-2026-34517

       Possible excessive memory usage caused by some multipart form fields        due to reading the entiry field into memory before checking        client_max_size.

    CVE-2026-34518

       Leaking sensitive information by dropping the Cookie and the Proxy-        Authorization headers when following redirects to a different        origin.

    CVE-2026-34519

       Header injection via the reason parameter.

    CVE-2026-34520

       Possible security bypass by checking header values for control        characters accordingly to RFC 9110.

    CVE-2026-34525

       Disallow duplicate headers, like host headers, except for in lax        mode.

    CVE-2026-34993

       Arbitrary code execution when using CookieJar.load() with untrusted        input.

    CVE-2026-47265

       Possible data leak.

    CVE-2026-50269

       An attacker-controlled input included into multipart/payload headers        can be used to modify a request to inject additional headers or        similar.

    CVE-2026-54274

       An attacker can send large incomplete websocket frame payloads and        bypasses the usual size limits on memory use.

    CVE-2026-54277

       An attacker may be able to send oversized lines through the HTTP        parser and use an excessive amount of memory, potentially leading to        a DoS.

    CVE-2026-54279

       Host-only cookies saved with CookieJar.save() and then later        restored with CookieJar.load() lose their host-only status.

    CVE-2026-54280

       Possible resource starvation caused when payload resources are not        closed correctly when a client disconnects in the middle of a write.

    CVE-2026-59881

       The WebSocket client accepts and decompresses frames with the RSV1        bit set even when the permessage-deflate extension was not        negotiated, allowing a malicious server to cause unexpected CPU and        memory consumption.

    CVE-2026-69243

       The HTTP parsers are vulnerable to a request smuggling attack        relating to WebSocket upgrades.


    For Debian 12 bookworm, these problems have been fixed in version     3.8.4-1+deb12u2.

    We recommend that you upgrade your python-aiohttp packages.

    For the detailed security status of python-aiohttp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-aiohttp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3059-1 advisory.

    This update for python-aiohttp fixes the following issues

    - CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
    - CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
    - CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
    - CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
    - CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
    - CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information     disclosure (bsc#1261332).
    - CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
    - CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
    - CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
    - CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
    - CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-     origin redirect (bsc#1267561).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3207-1 advisory.

    This update for python-aiohttp fixes the following issues

    - CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and     a denial of       service (bsc#1261320).
    - CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service     (bsc#1261321).
    - CVE-2026-34514: `content_type` parameter manipulation can lead to header injection (bsc#1261322).
    - CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a     denial of       service (bsc#1261329).
    - CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of     service       (bsc#1261331).
    - CVE-2026-34518: retained `Cookie` and `Proxy-Authorization` headers when following redirects can lead to     information       disclosure (bsc#1261332).
    - CVE-2026-34519: response `reason` parameter can be use to perform header injection (bsc#1261334).
    - CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).
    - CVE-2026-34525: multiple `Host` headers allow for potential security bypass in proxy servers     (bsc#1261343).
    - CVE-2026-34993: loading untrusted input in `CookieJar.load()` can lead to arbitrary code execution     (bsc#1267471).
    - CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-     origin redirect       and can leak sensitive data (bsc#1267561).
    - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart     headers       (bsc#1268398).
    - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource     consumption       (bsc#1268543).
    - CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via     excessive       resource consumption (bsc#1268544).
    - CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused     (bsc#1268549).
    - CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive     resource       consumption (bsc#1268556).
    - CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a     DoS       (bsc#1268559).
    - CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).
    - CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a     write and       can cause resource starvation (bsc#1268561).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
439654	SCA: security update for aiohttp (GHSA-mwh4-6h8g-pg8w)	Tenable Self-Hosted Container Security	SCA Checks	4/2/2026	7/2/2026	medium
458685	Echo: python-aiohttp: security update to 3.13.3-3+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/16/2026	medium
439654	SCA: security update for aiohttp (GHSA-mwh4-6h8g-pg8w)	Tenable Cloud Security	SCA Checks	4/2/2026	7/2/2026	medium
458685	Echo: python-aiohttp: security update to 3.13.3-3+e4	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/16/2026	medium
304811	aioHTTP < 3.13.4 Multiple Vulnerabilities (CVE-2026-22815)	Nessus	Misc.	4/3/2026	4/16/2026	high
323099	SUSE SLES16 Security Update : python-aiohttp (SUSE-SU-2026:22173-1)	Nessus	SuSE Local Security Checks	6/26/2026	9/18/2026	high
304758	Linux Distros Unpatched Vulnerability : CVE-2026-34519	Nessus	Misc.	4/3/2026	11/1/2026	medium
370504	Oracle Linux 9 : python-oci-sdk (ELSA-2026-604898)	Nessus	Oracle Linux Local Security Checks	10/22/2026	10/22/2026	high
318080	Debian dla-4613 : python-aiohttp-doc - security update	Nessus	Debian Local Security Checks	6/1/2026	6/1/2026	high
374702	Debian dla-4876 : python-aiohttp-doc - security update	Nessus	Debian Local Security Checks	11/1/2026	11/1/2026	high
327318	SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3059-1)	Nessus	SuSE Local Security Checks	7/16/2026	9/18/2026	high
329280	SUSE SLED15 / SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3207-1)	Nessus	SuSE Local Security Checks	7/24/2026	9/18/2026	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

high

medium

high

high

high

high

high