diff mbox series

[meta-python,scarthgap] python3-aiohttp: ignore CVE-2026-34515

Message ID 20260826071609.849718-1-dkelaiya@cisco.com
State New
Headers show
Series [meta-python,scarthgap] python3-aiohttp: ignore CVE-2026-34515 | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Aug. 26, 2026, 7:16 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Analysis:
- The upstream advisory limits the issue to aiohttp applications running
  on Windows and identifies the affected and fixed versions [1].
- The advisory-selected upstream fix rejects absolute static resource
  paths, explicitly including UNC and Windows drive paths [2].
- NVD independently describes the issue as Windows-specific and records
  the same upstream commit as the patch [3].
- Hence ignoring the CVE for now.

Reference:
[1] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m
[2] https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34515

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb b/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb
index 84a9f2e668..6f89a18b13 100644
--- a/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb
+++ b/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb
@@ -13,6 +13,8 @@  SRC_URI += "file://CVE-2024-52304.patch \
            file://CVE-2025-69228.patch \
            "
 
+CVE_STATUS[CVE-2026-34515] = "not-applicable-platform: Vulnerability only affects applications running on Windows"
+
 PYPI_PACKAGE = "aiohttp"
 inherit python_setuptools_build_meta pypi