2 lines
69 KiB
JSON
2 lines
69 KiB
JSON
|
{"dependencies": [{"name": "a2a", "version": "0.44", "vulns": []}, {"name": "a2a-sdk", "version": "0.3.24", "vulns": []}, {"name": "acryl-datahub", "version": "1.5.0.9", "vulns": []}, {"name": "aiofiles", "version": "24.1.0", "vulns": []}, {"name": "aiohappyeyeballs", "version": "2.6.1", "vulns": []}, {"name": "aiohttp", "version": "3.13.3", "vulns": [{"id": "CVE-2026-34515", "fix_versions": ["3.13.4"], "aliases": ["GHSA-p998-jp59-783m"], "description": "### Summary On Windows the static resource handler may expose information about a NTLMv2 remote path. ### Impact If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there. ----- Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d"}, {"id": "CVE-2026-34513", "fix_versions": ["3.13.4"], "aliases": ["GHSA-hcc4-c3v8-rx92"], "description": "### Summary An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. ### Impact If an application makes requests to a very large number of hosts, this could cause the DNS cache to continue growing and slowly use excessive amounts of memory. ----- Patch: https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98"}, {"id": "CVE-2026-34516", "fix_versions": ["3.13.4"], "aliases": ["GHSA-m5qp-6w8w-w647"], "description": "### Summary A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. ### Impact Multipart headers were not subject to the same size restrictions in place for normal headers, potentially allowing substantially more data to be loaded into memory than intended. However, other restrictions in place limit the impact of this vulnerability. ----- Patch: https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f"}, {"id": "CVE-2026-34517", "fix_versions": ["3.13.4"], "aliases": ["GHSA-3wq7-rqq7-wx6j"], "description": "### Summary For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. ### Impact If an application uses `Request.post()` an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected. ----- Patch: https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145"}, {"id": "CVE-2026-34519", "fix_versions": ["3.13.4"], "aliases": ["GHSA-mwh4-6h8g-pg8w"], "description": "### Summary An attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits. ### Impact In the unlikely situation that an application allows untrusted data to be used in the response's `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended. ----- Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b"}, {"id": "CVE-2026-34518", "fix_versions": ["3.13.4"], "aliases": ["GHSA-966j-vmvw-g2g9"], "description": "### Summary When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. ### Impact The Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect. ----- Patch: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6"}, {"id": "CVE-2026-34520", "fix_versions": ["3.13.4"], "aliases": ["GHSA-63hf-3vf5-4wqf"], "description": "### Summary The C parser (the default for most installs) accepted null bytes and control characters is response headers. ### Impact An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `re
|