TEST-INFRA: [dependency-security] aiohttp@3.13.3 - 8 untracked CVEs (CVE-2026-34514, 34516, 34517, 34518, 34519, 34520, 34525, CVE-2026-22815) #2228

New issue

Open

opened 2026-04-03 09:40:09 +00:00 by freemo · 0 comments

freemo commented

2026-04-03 09:40:09 +00:00

Owner

Metadata

Branch: fix/dependency-security-aiohttp-untracked-cves
Commit Message: fix(deps): document remediation of 8 untracked aiohttp CVEs fixed by >=3.13.4 constraint
Milestone: v3.8.0
Parent Epic: #362

Vulnerability Details

The OSV database reports 10 vulnerabilities in aiohttp@3.13.3. Two were previously tracked (#1544, #1549). The following 8 CVEs were never tracked in this repository:

CVE	GHSA	Summary	Severity (CVSS v4)	Fixed In
CVE-2026-34514	GHSA-2vrm-gr82-f7m5	CRLF injection through multipart part content type header construction	Low (VI:L)	3.13.4
CVE-2026-34516	GHSA-m5qp-6w8w-w647	Multipart Header Size Bypass — unbounded memory DoS	High (VA:H)	3.13.4
CVE-2026-34517	GHSA-3wq7-rqq7-wx6j	Late size enforcement for non-file multipart fields — memory DoS	Low (VA:L)	3.13.4
CVE-2026-34518	GHSA-966j-vmvw-g2g9	Cookie and Proxy-Authorization headers leaked on cross-origin redirect	Low (VC:L)	3.13.4
CVE-2026-34519	GHSA-mwh4-6h8g-pg8w	HTTP response splitting via `\r` in reason phrase	Low (VI:L)	3.13.4
CVE-2026-34520	GHSA-63hf-3vf5-4wqf	C parser (llhttp) accepts null bytes and control characters in response headers — header injection/security bypass	Low (VI:L)	3.13.4
CVE-2026-34525	GHSA-c427-h43c-vf67	Accepts duplicate Host headers	Low (VI:L, SI:L)	3.13.4
CVE-2026-22815	GHSA-w2fm-2cpv-w7v5	Unlimited trailer headers — uncapped memory usage DoS	Low (VA:L)	3.13.4

Current Status

The fix is already in place. pyproject.toml already constrains aiohttp>=3.13.4 (added as part of #1544/#1549 remediation). The installed version resolves to 3.13.5. All 8 CVEs above are remediated by this constraint.

This issue exists to:

Formally track the 8 previously untracked CVEs in the project's security history.
Verify that the existing >=3.13.4 constraint is correctly documented as covering all 10 CVEs (not just CVE-2026-34515 as the current comment states).
Update the pyproject.toml comment to reference all relevant CVEs.

Recommendation

Update the inline comment in pyproject.toml from:

"aiohttp>=3.13.4",  # CVE-2026-34515 mitigation: open redirect vulnerability

to:

"aiohttp>=3.13.4",  # Mitigates 10 CVEs in 3.13.3: CVE-2026-34513 through CVE-2026-34525 and CVE-2026-22815

Subtasks

Update pyproject.toml comment to reference all 10 CVEs mitigated by >=3.13.4
Run nox -e lint and confirm no new lint violations
Run nox -e typecheck and confirm no new type errors
Run nox -e unit_tests and confirm all Behave scenarios pass
Run nox -e coverage_report and confirm coverage remains >= 97%
Verify aiohttp==3.13.4 (or later) appears in the resolved lockfile

Definition of Done

pyproject.toml comment updated to reference all 10 CVEs
No regressions introduced in any nox session
All nox stages pass
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Unknown | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/dependency-security-aiohttp-untracked-cves` - **Commit Message**: `fix(deps): document remediation of 8 untracked aiohttp CVEs fixed by >=3.13.4 constraint` - **Milestone**: v3.8.0 - **Parent Epic**: #362 ## Vulnerability Details The OSV database reports **10 vulnerabilities** in `aiohttp@3.13.3`. Two were previously tracked (#1544, #1549). The following **8 CVEs were never tracked** in this repository: | CVE | GHSA | Summary | Severity (CVSS v4) | Fixed In | |-----|------|---------|-------------------|----------| | CVE-2026-34514 | GHSA-2vrm-gr82-f7m5 | CRLF injection through multipart part content type header construction | Low (VI:L) | 3.13.4 | | CVE-2026-34516 | GHSA-m5qp-6w8w-w647 | Multipart Header Size Bypass — unbounded memory DoS | High (VA:H) | 3.13.4 | | CVE-2026-34517 | GHSA-3wq7-rqq7-wx6j | Late size enforcement for non-file multipart fields — memory DoS | Low (VA:L) | 3.13.4 | | CVE-2026-34518 | GHSA-966j-vmvw-g2g9 | Cookie and Proxy-Authorization headers leaked on cross-origin redirect | Low (VC:L) | 3.13.4 | | CVE-2026-34519 | GHSA-mwh4-6h8g-pg8w | HTTP response splitting via `\r` in reason phrase | Low (VI:L) | 3.13.4 | | CVE-2026-34520 | GHSA-63hf-3vf5-4wqf | C parser (llhttp) accepts null bytes and control characters in response headers — header injection/security bypass | Low (VI:L) | 3.13.4 | | CVE-2026-34525 | GHSA-c427-h43c-vf67 | Accepts duplicate Host headers | Low (VI:L, SI:L) | 3.13.4 | | CVE-2026-22815 | GHSA-w2fm-2cpv-w7v5 | Unlimited trailer headers — uncapped memory usage DoS | Low (VA:L) | 3.13.4 | ## Current Status **The fix is already in place.** `pyproject.toml` already constrains `aiohttp>=3.13.4` (added as part of #1544/#1549 remediation). The installed version resolves to `3.13.5`. All 8 CVEs above are remediated by this constraint. This issue exists to: 1. Formally track the 8 previously untracked CVEs in the project's security history. 2. Verify that the existing `>=3.13.4` constraint is correctly documented as covering all 10 CVEs (not just CVE-2026-34515 as the current comment states). 3. Update the `pyproject.toml` comment to reference all relevant CVEs. ## Recommendation Update the inline comment in `pyproject.toml` from: ``` "aiohttp>=3.13.4", # CVE-2026-34515 mitigation: open redirect vulnerability ``` to: ``` "aiohttp>=3.13.4", # Mitigates 10 CVEs in 3.13.3: CVE-2026-34513 through CVE-2026-34525 and CVE-2026-22815 ``` ## Subtasks - [ ] Update `pyproject.toml` comment to reference all 10 CVEs mitigated by `>=3.13.4` - [ ] Run `nox -e lint` and confirm no new lint violations - [ ] Run `nox -e typecheck` and confirm no new type errors - [ ] Run `nox -e unit_tests` and confirm all Behave scenarios pass - [ ] Run `nox -e coverage_report` and confirm coverage remains >= 97% - [ ] Verify `aiohttp==3.13.4` (or later) appears in the resolved lockfile ## Definition of Done - [ ] `pyproject.toml` comment updated to reference all 10 CVEs - [ ] No regressions introduced in any nox session - All nox stages pass - Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Unknown | Agent: ca-new-issue-creator

freemo added this to the v3.8.0 milestone

2026-04-03 09:40:20 +00:00

freemo added a new dependency

2026-04-03 09:41:26 +00:00

#362 Epic: Security & Safety Hardening