mbox series

[meta-python,wrynose,0/7] python3-aiohttp: Security fixes

Message ID 20261106072702.502813-1-dkelaiya@cisco.com
Headers show
Series python3-aiohttp: Security fixes | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 6, 2026, 7:26 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Backport seven aiohttp security fixes to the 3.13.5 recipe on Wrynose.
The series follows the upstream fix order. The fixes and included
corrections are present in upstream 3.14.4.

The fixes cover multipart descriptor exhaustion, HEAD request body
framing, host-only cookie scope, Max-Age overflow and response cleanup,
request-scheme spoofing, Secure shared-cookie leakage, and the initial
idle-connection deadline.

Include the upstream descriptor-test, authority-validation and
trusted-origin corrections with their corresponding CVE fixes.

Darsh Kelaiya (7):
  python3-aiohttp: fix CVE-2026-111066
  python3-aiohttp: fix CVE-2026-111750
  python3-aiohttp: fix CVE-2026-111749
  python3-aiohttp: fix CVE-2026-111065
  python3-aiohttp: fix CVE-2026-111748
  python3-aiohttp: fix CVE-2026-111063
  python3-aiohttp: fix CVE-2026-111064

 .../python3-aiohttp/CVE-2026-111063_p1.patch       | 137 +++++++
 .../python3-aiohttp/CVE-2026-111063_p2.patch       | 244 +++++++++++++
 .../python/python3-aiohttp/CVE-2026-111064.patch   | 285 +++++++++++++++
 .../python/python3-aiohttp/CVE-2026-111065.patch   | 176 +++++++++
 .../python3-aiohttp/CVE-2026-111066_p1.patch       | 400 +++++++++++++++++++++
 .../python3-aiohttp/CVE-2026-111066_p2.patch       |  57 +++
 .../python3-aiohttp/CVE-2026-111748_p1.patch       | 376 +++++++++++++++++++
 .../python3-aiohttp/CVE-2026-111748_p2.patch       | 282 +++++++++++++++
 .../python/python3-aiohttp/CVE-2026-111749.patch   | 205 +++++++++++
 .../python/python3-aiohttp/CVE-2026-111750.patch   |  83 +++++
 .../python/python3-aiohttp_3.13.5.bb               |  10 +
 11 files changed, 2255 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111063_p1.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111063_p2.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111064.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111065.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111066_p1.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111066_p2.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111748_p1.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111748_p2.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111749.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111750.patch