Ubuntu alert USN-8591-1 (python-aiohttp)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8591-1] AIOHTTP vulnerabilities
Date:
             
 
Wed, 22 Jul 2026 23:25:39 +0000
Message-ID:
             
 
<E1wmgJn-0008AU-3C@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8591-1
July 22, 2026

python-aiohttp vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in AIOHTTP.

Software Description:
- python-aiohttp: Asynchronous HTTP client/server Python framework

Details:

Sean Gilligan discovered that AIOHTTP did not properly limit memory
usage when processing HTTP headers and trailers. An attacker could
possibly use this issue to consume excessive system resources, resulting
in a denial of service. (CVE-2026-22815)

It was discovered that AIOHTTP did not properly limit the size of its
DNS cache. An attacker could possibly use this issue to consume
excessive system resources, resulting in a denial of service.
(CVE-2026-34513)

Mingi Jung discovered that AIOHTTP did not properly sanitize the
content_type parameter. An attacker could possibly use this issue to
inject malicious HTTP headers, resulting in HTTP response splitting.
(CVE-2026-34514)

It was discovered that AIOHTTP did not properly limit memory usage when
processing multipart headers. An attacker could possibly use this issue
to consume excessive system resources, resulting in a denial of service.
(CVE-2026-34516)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  python3-aiohttp                 3.13.3-3ubuntu1+esm1
                                  Available with Ubuntu Pro

Ubuntu 24.04 LTS
  python3-aiohttp                 3.9.1-1ubuntu0.1+esm3
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  python3-aiohttp                 3.8.1-4ubuntu0.2+esm3
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  python3-aiohttp                 3.6.2-1ubuntu1+esm6
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  python3-aiohttp                 3.0.1-1ubuntu0.1~esm7
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  python3-aiohttp                 0.20.2-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8591-1
  CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34516


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmphUQQACgkQcpJm3tlz
hgHtgw//c3V07LdDBxclwI9MvHFQpEHuJ3NXC+z69IYWrW9L0ZXLefe3b1RuUYzc
nOF3pHZ3sfLs1iqSlnkrV7J8N4LQao4J/pPw5l4dzL7D1F5lx9sbOv8SM+6o8qhY
9noH0Crq/KlDo11XRBFu+j+Aalcb8fTGTHSN7+wBWSx2wHSfwDXkEFWZ2N/Iln/l
N+0LjKpoYlLeoB1orcxNX4Foi8X5ZTAwCYhX0enakk6axueDzU+3V5MOaLKRjNlF
YvNbf3W0Xx/AV41QZB6OSa935G98dcC3iqfASulddA8GDZ4zDU2KSQYot5mveesz
BsiAd4irs0tETIdjvEycNuY385LfV5XOItt1rTnGtB5Wu5e5YnRcv8yg8/a0DgFx
Irpe/Izav4Mokm81tS68ReXZ7v2FvPOAxf2J7goN9QOb/bSptqLQmEQV8xnZpf/J
ArL7/ASjpRXn9w4H8BP7cEsdlBSC3nAT8OlpdjvdozhjlDE97i4VPrY8dkwqf81o
hhorUhhL0L93rr176nMlf1PAi4Meup6qzw5UN/NEIW/EC9UOpeTw1fd3Ze3aw8Ci
5JG1PJJOMKdI+nEUc802c25vI2jNvzo+lG7KkDOreNASqtWsx1JJLOJcjWias2vD
nxGypLu1HNXpASXV1rNUpnep69RDeJnycbthw/jdaG8BLcm4v+Y=
=KvYD
-----END PGP SIGNATURE-----