The python-aiohttp package had several security vulnerabilities: CVE-2026-50269 involves improper validation of user-controlled strings allowing CRLF injection in multipart headers. CVE-2026-54273 and CVE-2026-54274 relate to lack of limits on HTTP/1 pipelined request queues and incomplete websocket frame payloads, respectively, both causing excessive resource consumption leading to denial of service. CVE-2026-54275 is a TLS SNI check bypass when reusing existing connections. CVE-2026-54277 involves bypassing max_line_size limits with the optimized C HTTP parser, causing resource exhaustion. CVE-2026-54278 allows unread compressed request bodies to bypass client_max_size limits during cleanup, causing DoS. CVE-2026-54279 causes host-only cookies to become domain cookies after CookieJar persistence, potentially affecting cookie security. CVE-2026-54280 involves payload resources not closing correctly on client disconnects, causing resource starvation. These vulnerabilities were fixed in the update provided by the SUSE Product Security Team.

Exploitation of these vulnerabilities can lead to denial of service conditions through excessive resource consumption, memory exhaustion, and potential security bypasses such as TLS SNI check bypass and improper cookie domain handling. These issues affect the stability and security of applications using python-aiohttp, potentially allowing attackers to disrupt service or bypass security controls.

A security update for python-aiohttp has been released by the SUSE Product Security Team that fixes all listed vulnerabilities. Users should apply this update promptly to mitigate the risks. No additional mitigation steps are indicated beyond applying the official update.