[Git][security-tracker-team/security-tracker][master] Add notes about CVE-2026-54273/python-aiohttp

[Daniel Leidert (@dleidert)]

Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7dd8321d by Daniel Leidert at 2026-06-29T02:28:31+02:00
Add notes about CVE-2026-54273/python-aiohttp

The massive rewrite of the decompression handling in v3.14.0 contains the
required logic to make the C parser work (HPE_PAUSED). Without it, the fix
cannot be completed. But it is intrusive to backport. I therefore marked the
issue as ignored for Bookworm and Bullseye. Trixie might ship with the
incomplete fix.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -5491,8 +5491,12 @@ CVE-2026-54274 (AIOHTTP is an asynchronous HTTP client/server framework for asyn
 	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d (v3.14.1)
 CVE-2026-54273 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
 	- python-aiohttp 3.14.1-1
+	[bookworm] - python-aiohttp <ignored> (Too intrusive to backport)
+	[bullseye] - python-aiohttp <ignored> (Too intrusive to backport)
 	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc
 	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf (v3.14.1)
+	NOTE: Required code for C parser: https://github.com/aio-libs/aiohttp/commit/b502ae655c8788b469dcc832923a85d661719699 (v3.14.0)
+	NOTE: The C parser code changes are intrusive. Without them, the C parser can only be partially fixed.
 CVE-2026-54271 (protobufjs-cli is the command line add-on for protobuf.js. Prior to 1. ...)
 	NOT-FOR-US: protobufjs-cli
 CVE-2026-54270 (protobufjs compiles protobuf definitions into JavaScript (JS) function ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7dd8321def32015645f0bd3568b7742a9bdf2712

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7dd8321def32015645f0bd3568b7742a9bdf2712
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260629/ce4ed56c/attachment.htm>