Input validation error in aiohttp - CVE-2026-59881

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU139887

Input validation error in aiohttp - CVE-2026-59881

Published: July 28, 2026


Vulnerability identifier: #VU139887
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59881
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


Affected software

aiohttp
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Public Cloud Module
Python 3 Module
openSUSE Leap
openEuler
Fedora
python3-aiohttp-debuginfo
python3-aiohttp
python-aiohttp-debugsource
python311-aiohttp-debuginfo
python311-aiohttp
python-aiohttp-debuginfo
python-aiohttp-help
python-aiohttp

How to mitigate CVE-2026-59881

Install updates from vendor's website.

aiohttp - update to 3.14.2
python3-aiohttp-debuginfo - update to 3.6.0-150100.3.41.1
python3-aiohttp - update to 3.6.0-150100.3.41.1
python-aiohttp-debugsource - addressed in versions 3.6.0-150100.3.41.1, 3.9.3-150400.10.46.1
python311-aiohttp-debuginfo - update to 3.9.3-150400.10.46.1
python311-aiohttp - update to 3.9.3-150400.10.46.1
python-aiohttp-debuginfo - update to 3.14.3-1
python3-aiohttp - update to 3.14.3-1
python-aiohttp-help - update to 3.14.3-1
python-aiohttp-debugsource - update to 3.14.3-1
python-aiohttp - update to 3.14.3-1
python-aiohttp - addressed in versions 3.14.3-3.fc45, 3.14.3-3.fc46

External References

Related Security Bulletins