Skip to content

Commit 8067ea3

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2vrm-gr82-f7m5 GHSA-7xxh-373w-35vg GHSA-hcc4-c3v8-rx92
1 parent 63fdd8c commit 8067ea3

File tree

3 files changed

+185
-0
lines changed

3 files changed

+185
-0
lines changed

‎advisories/github-reviewed/2026/04/GHSA-2vrm-gr82-f7m5/GHSA-2vrm-gr82-f7m5.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2vrm-gr82-f7m5",
4+
"modified": "2026-04-01T21:20:06Z",
5+
"published": "2026-04-01T21:20:06Z",
6+
"aliases": [
7+
"CVE-2026-34514"
8+
],
9+
"summary": "AIOHTTP has CRLF injection through multipart part content type header construction",
10+
"details": "### Summary\n\nAn attacker who controls the `content_type` parameter in aiohttp could use this to inject extra headers or similar exploits.\n\n### Impact\n\nIf an application allows untrusted data to be used for the multipart `content_type` parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "aiohttp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.13.4"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.13.3"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2vrm-gr82-f7m5"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/aio-libs/aiohttp"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-113"
58+
],
59+
"severity": "LOW",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-04-01T21:20:06Z",
62+
"nvd_published_at": null
63+
}
64+
}

‎advisories/github-reviewed/2026/04/GHSA-7xxh-373w-35vg/GHSA-7xxh-373w-35vg.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7xxh-373w-35vg",
4+
"modified": "2026-04-01T21:19:03Z",
5+
"published": "2026-04-01T21:19:03Z",
6+
"aliases": [
7+
"CVE-2026-34747"
8+
],
9+
"summary": "Payload has an SQL Injection via Query Handling",
10+
"details": "### Impact\n\nCertain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.\n\n### Patches\n\nThis issue has been fixed in **v3.79.1** and later. Query input validation has been hardened.\n\nUpgrade to **v3.79.1 or later**.\n\n### Workarounds\n\nUntil developers can upgrade:\n\n- Limit access to endpoints that accept dynamic query inputs to trusted users only. \n- Validate or sanitize input from untrusted clients before sending it to query endpoints.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "payload"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.79.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/payloadcms/payload"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-89"
51+
],
52+
"severity": "HIGH",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-04-01T21:19:03Z",
55+
"nvd_published_at": null
56+
}
57+
}

‎advisories/github-reviewed/2026/04/GHSA-hcc4-c3v8-rx92/GHSA-hcc4-c3v8-rx92.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hcc4-c3v8-rx92",
4+
"modified": "2026-04-01T21:19:22Z",
5+
"published": "2026-04-01T21:19:22Z",
6+
"aliases": [
7+
"CVE-2026-34513"
8+
],
9+
"summary": "AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector",
10+
"details": "### Summary\n\nAn unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.\n\n### Impact\n\nIf an application makes requests to a very large number of hosts, this could cause the DNS cache to continue growing and slowly use excessive amounts of memory.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "aiohttp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.13.4"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.13.3"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hcc4-c3v8-rx92"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/aio-libs/aiohttp"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-770"
58+
],
59+
"severity": "LOW",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-04-01T21:19:22Z",
62+
"nvd_published_at": null
63+
}
64+
}

0 commit comments

Comments
 (0)