Skip to content

Commit 5598f03

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6jhg-hg63-jvvf GHSA-fh55-r93g-j68g GHSA-g84x-mcqj-x9qq GHSA-jqmr-2pg9-vfx7
1 parent 4a86fd1 commit 5598f03

4 files changed

Lines changed: 233 additions & 4 deletions

File tree

‎advisories/github-reviewed/2026/01/GHSA-6jhg-hg63-jvvf/GHSA-6jhg-hg63-jvvf.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6jhg-hg63-jvvf",
4+
"modified": "2026-01-05T23:13:14Z",
5+
"published": "2026-01-05T23:13:14Z",
6+
"aliases": [
7+
"CVE-2025-69228"
8+
],
9+
"summary": "AIOHTTP vulnerable to denial of service through large payloads",
10+
"details": "### Summary\nA request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing.\n\n### Impact\nIf an application includes a handler that uses the `Request.post()` method, an attacker may be able to freeze the server by exhausting the memory.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "aiohttp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.13.3"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.13.2"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/aio-libs/aiohttp"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-770"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-01-05T23:13:14Z",
62+
"nvd_published_at": null
63+
}
64+
}

‎advisories/github-reviewed/2026/01/GHSA-fh55-r93g-j68g/GHSA-fh55-r93g-j68g.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fh55-r93g-j68g",
4+
"modified": "2026-01-05T23:13:46Z",
5+
"published": "2026-01-05T23:13:46Z",
6+
"aliases": [
7+
"CVE-2025-69230"
8+
],
9+
"summary": "AIOHTTP Vulnerable to Cookie Parser Warning Storm",
10+
"details": "### Summary\nReading multiple invalid cookies can lead to a logging storm.\n\n### Impact\nIf the ``cookies`` attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "aiohttp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.13.3"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.13.2"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-fh55-r93g-j68g"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/aio-libs/aiohttp"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-779"
58+
],
59+
"severity": "LOW",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-01-05T23:13:46Z",
62+
"nvd_published_at": null
63+
}
64+
}

‎advisories/github-reviewed/2026/01/GHSA-g84x-mcqj-x9qq/GHSA-g84x-mcqj-x9qq.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g84x-mcqj-x9qq",
4+
"modified": "2026-01-05T23:13:29Z",
5+
"published": "2026-01-05T23:13:29Z",
6+
"aliases": [
7+
"CVE-2025-69229"
8+
],
9+
"summary": "AIOHTTP vulnerable to DoS through chunked messages",
10+
"details": "### Summary\n\nHandling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.\n\n### Impact\n\nIf an application makes use of the `request.read()` method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712\nPatch: https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "aiohttp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.13.3"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.13.2"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712"
53+
},
54+
{
55+
"type": "PACKAGE",
56+
"url": "https://github.com/aio-libs/aiohttp"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-770"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-01-05T23:13:29Z",
66+
"nvd_published_at": null
67+
}
68+
}

advisories/unreviewed/2026/01/GHSA-jqmr-2pg9-vfx7/GHSA-jqmr-2pg9-vfx7.json renamed to advisories/github-reviewed/2026/01/GHSA-jqmr-2pg9-vfx7/GHSA-jqmr-2pg9-vfx7.json

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,69 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jqmr-2pg9-vfx7",
4-
"modified": "2026-01-05T15:32:15Z",
4+
"modified": "2026-01-05T23:14:54Z",
55
"published": "2026-01-05T15:32:15Z",
66
"aliases": [
77
"CVE-2025-68280"
88
],
9+
"summary": "Apache SIS has Improper Restriction of XML External Entity Reference vulnerability",
910
"details": "Improper Restriction of XML External Entity Reference vulnerability in Apache SIS.\n\n\n\nIt is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the following SIS services:\n\n\n\n\n * Reading of GeoTIFF files having the GEO_METADATA tag defined by the Defense Geospatial Information Working Group (DGIWG).\n\n * Parsing of ISO 19115 metadata in XML format.\n\n * Parsing of Coordinate Reference Systems defined in the GML format.\n\n * Parsing of files in GPS Exchange Format (GPX).\n\n\n\n\n\nThis issue affects Apache SIS from versions 0.4 through 1.5 inclusive. Users are recommended to upgrade to version 1.6, which will fix the issue. In the meantime, the security vulnerability can be avoided by launching Java with the javax.xml.accessExternalDTD system property sets to a comma-separated list of authorized protocols. For example:\n\n\n\njava -Djavax.xml.accessExternalDTD=\"\" ...",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.sis.core:sis-metadata"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0.4"
29+
},
30+
{
31+
"fixed": "1.6"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68280"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/sis"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://lists.apache.org/thread/s4ggy3zbtrrn93glgo2vn52lgcxk4bp4"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "http://www.openwall.com/lists/oss-security/2026/01/05/11"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "http://www.openwall.com/lists/oss-security/2026/01/05/7"
2558
}
2659
],
2760
"database_specific": {
2861
"cwe_ids": [
2962
"CWE-611"
3063
],
3164
"severity": "MODERATE",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-01-05T23:14:54Z",
3467
"nvd_published_at": "2026-01-05T14:15:53Z"
3568
}
3669
}

0 commit comments

Comments
 (0)