mbox series

[meta-python,wrynose,0/3] python3-aiohttp: fix multiple CVEs

Message ID 20261016064219.3910025-1-dkelaiya@cisco.com
Headers show
Series python3-aiohttp: fix multiple CVEs | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 6:42 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Backport three upstream aiohttp security fixes to the 3.13.5 recipe
on wrynose: CVE-2026-59881, CVE-2026-69243, and CVE-2026-69244.

The series fixes WebSocket compression handling, rejected WebSocket
upgrade request-body parsing, and bounded error messages in the C
HTTP parser.
The individual commits retain upstream fix and advisory references.

This series depends on the previously submitted Wrynose fix for
CVE-2026-54273, which has not merged yet. Apply that patch [1] before
this series. It provides the HTTP parser queue-limit changes and
recipe-time Cython regeneration used by these backports.

[1] https://patchwork.yoctoproject.org/project/oe/patch/20260928174806.1818191-1-dkelaiya@cisco.com/

Darsh Kelaiya (3):
  python3-aiohttp: fix CVE-2026-59881
  python3-aiohttp: fix CVE-2026-69243
  python3-aiohttp: fix CVE-2026-69244

 .../python3-aiohttp/CVE-2026-59881.patch      | 103 ++++++
 .../python3-aiohttp/CVE-2026-69243.patch      | 307 ++++++++++++++++++
 .../python3-aiohttp/CVE-2026-69244.patch      | 159 +++++++++
 .../python/python3-aiohttp_3.13.5.bb          |   3 +
 4 files changed, 572 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-59881.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-69243.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-69244.patch