{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5a944436-5de6-5550-8758-383c0b7aa268", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "type": "library", "name": "aiohttp", "version": "3.8.6.post8+tuxcare", "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:183107ad-1a4c-5846-9778-d75960570366", "id": "CVE-2023-49081", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:681e24c9-6cb8-56c0-95ec-57825e8650c9", "id": "CVE-2023-49082", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:5f846657-01e2-5d93-b6ad-625219b662c5", "id": "CVE-2024-23334", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23334 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:2f31d3c4-576d-5fbb-8e45-4557ecf7076f", "id": "CVE-2024-23829", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23829 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:6347eb76-07e2-5590-821c-b51e155c4179", "id": "CVE-2024-27306", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-27306 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:61f25785-a1d7-5c63-b6f1-97d5afc02134", "id": "CVE-2024-30251", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:db575079-9ab8-5d6f-ba39-5d484375d640", "id": "CVE-2024-52304", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52304 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:81ddd731-82d6-5284-a186-90b2a1ca39da", "id": "CVE-2025-53643", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53643 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:d1ee88e7-fd17-5de3-8201-9232a6294300", "id": "CVE-2025-69223", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69223 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:47fb1b60-b78f-5087-b391-f0bfd7d2653a", "id": "CVE-2025-69224", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69224 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:f10ee7e8-0bc4-529c-96c2-501743423ef2", "id": "CVE-2025-69225", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69225 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:942382d6-1647-57e9-9719-1a41e24c9a24", "id": "CVE-2025-69226", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69226 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:c880e7be-9435-5eba-8bef-24cf0d1fe9a3", "id": "CVE-2025-69227", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69227 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:2dd443d0-ddde-5a3f-9b77-8134f1d221dc", "id": "CVE-2025-69228", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69228 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:39a2585a-7a0a-58a0-9f8e-a800c30e7333", "id": "CVE-2025-69229", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69229 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:76b5dec1-f42d-5576-b840-414416fdc7a6", "id": "CVE-2025-69230", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-69230 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:63bb753b-60ef-511b-ab3a-ce45259195a5", "id": "CVE-2026-22815", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:308010ae-da9b-5d18-ae0e-03b1661c3317", "id": "CVE-2026-34513", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:e6b1b81c-9787-55eb-96bc-83c6594495be", "id": "CVE-2026-34514", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:ca6377ba-f633-5133-8f6a-eb9108dd91c5", "id": "CVE-2026-34515", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34515 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:b6d9e821-43a0-543c-892a-ea2b9c5c60a9", "id": "CVE-2026-34516", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:bb838d68-6281-5a9e-b575-ba797833d9bd", "id": "CVE-2026-34517", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:70b348f8-5126-55bf-aded-9d5e4959b8e0", "id": "CVE-2026-34518", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:6fa27528-012f-50a0-b0d1-c8f96d94339f", "id": "CVE-2026-34519", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:c1c45291-f98f-5e00-ab95-2a6f518bcdbc", "id": "CVE-2026-34520", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:49038862-800e-510f-88f8-577e5538e9fd", "id": "CVE-2026-34525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:5c73d29a-05f6-59a5-8229-05df4b5500cc", "id": "CVE-2026-34993", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34993 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:6c233d26-2d6c-5aa6-9aac-0d34f1f81bb8", "id": "CVE-2026-47265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:bed0c7c0-77ab-5575-b753-4aa1406c2ee0", "id": "CVE-2026-50269", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:8572897c-b8f9-5a9c-a6fb-a9cbdcf7c5e7", "id": "CVE-2026-54273", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:6e1a79b8-7b33-5490-9865-ee6cbdc73895", "id": "CVE-2026-54274", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:cf4882f7-e6c9-5e08-9380-c9342b275b84", "id": "CVE-2026-54275", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post8+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:74fcdf01-853b-530b-b06c-f0a7c950d2e5", "id": "CVE-2026-54276", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post8+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:4fab018a-4cb5-5624-a9f5-a5afdcc0fcb3", "id": "CVE-2026-54277", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:51787e9d-2943-5dee-844f-8521f4eb1d87", "id": "CVE-2026-54278", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:99034e1f-971c-59f6-8766-00d308a1f889", "id": "CVE-2026-54279", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:1db4d49d-8d55-5edd-ba2c-143a1ab13b58", "id": "CVE-2026-54280", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post8+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:fc91ec6d-50d0-5a24-8dcc-9b3c89651e12", "id": "CVE-2026-59881", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59881 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:f9256dc3-7cc1-5428-a21f-0fb4a488614f", "id": "CVE-2026-69243", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69243 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }, { "bom-ref": "urn:uuid:af682848-b612-5e6d-a750-835b7b43c91d", "id": "CVE-2026-69244", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69244 affects version 3.8.6.post8+tuxcare of aiohttp." }, "affects": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] } ], "dependencies": [ { "ref": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } ] }