OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing grant and scope validation to be performed under that other client identity. This affects the client_credentials and password grant flows. The flaw allows an attacker with valid credentials for one client to obtain tokens with the privileges of another client if the application validator authorizes based on the attacker-supplied client_id argument. The issue is fixed in OAuthlib version 0.21.0_1.
## Summary
A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation
of the Authorization Code Grant flow. The `code_challenge_method_plain` function
uses Python's standard `==` operator for string comparison instead of a
constant-time comparison function, potentially allowing timing-based attacks.
## Affected Component
- File: `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py`
- Functions: `code_challenge_method_plain`, `code_challenge_method_s256`
- Vulnerability Type: CWE-208 (Observable Timing Discrepancy)
## Technical Details
Python's `==` operator uses short-circuit evaluation when comparing strings:
1. Returns `False` immediately if lengths differ
2. Compares characters left-to-right, stopping at first mismatch
This means comparison time varies linearly with the length of the common prefix
between the attacker-supplied verifier and the stored challenge, creating a
measurable timing oracle.
## Proof of Concept
Tested locally against oauthlib source (network jitter eliminated to isolate
pure Python execution time):
| Input | Result | Time (10M iterations) |
|---|---|---|
| Wrong first char (`B` + `A`*49) | Fast reject | 0.34106s |
| 49 chars correct (`A`*49 + `B`) | Deep compare | 0.37847s |
| **Difference** | | **0.03741s** |
The ~37ms delta over 10M iterations corresponds to nanosecond-level differences
per call, which are statistically exploitable under controlled conditions.
## Attack Scenario
1. Attacker intercepts `authorization_code` via Custom URI Scheme Hijacking
2. PKCE blocks token request — attacker lacks `code_verifier`
3. Attacker sends repeated requests to `/token` endpoint measuring response times
4. Using timing oracle, attacker recovers `code_verifier` character by character
5. Attacker obtains Access Token → Account Takeover
> **Note:** Practical exploitability is limited due to the single-use nature of
> authorization codes and real-world network noise. However, the vulnerable
> pattern should be corrected as a defense-in-depth measure.
## Recommended Fix
Replace `==` with `hmac.compare_digest()` for constant-time comparison:
cr: Elvin Latifli
This update for python-aiohttp fixes the following issues:
- CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated
permessage-deflate (bsc#1273125).
- CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553).
- CVE-2026-69244: out-of-bounds heap read in the C response parser while building an error message for a malformed
response (bsc#1273552).
Vdirsyncer versions from 0.19.0 up to but not including 0.19.2_4 are affected by a vulnerability in a dependency, aiohttp, which uses llhttp 8.1.1. This version of llhttp is vulnerable to two request smuggling vulnerabilities. The issue is resolved by upgrading to llhttp 9 or later, which is included in aiohttp 3.8.6 and newer.
This update for python-aiohttp fixes the following issues
- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers
(bsc#1268398).
- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption
(bsc#1268543).
- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive
resource consumption (bsc#1268544).
- CVE-2026-54275: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549).
- CVE-2026-54277: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource
consumption (bsc#1268556).
- CVE-2026-54278: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS
(bsc#1268559).
- CVE-2026-54279: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560).
- CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and
can cause resource starvation (bsc#1268561).
This update for python-aiohttp fixes the following issues
- CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).
- CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).
- CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).
- CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).
- CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).
- CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure
(bsc#1261332).
- CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).
- CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).
- CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).
- CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).
- CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect
(bsc#1267561).
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
For details about this release, refer to the release notes listed in the References section.
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
For details about this release, refer to the release notes listed in the References section.
Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.
Security Fix(es):
* python-aiohttp: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643)
* python3.12-urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441)
* python3.12-urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471)
### Summary
The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.
### Impact
If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71