python-aiohttp (SUSE:Linux Enterprise Module for Public Cloud 15 SP4) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Public Cloud 15 SP4 package python-aiohttp, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (17)

• CVE-2025-69223 — CVSS 7.5 (high): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to…
• CVE-2025-69228 — CVSS 7.5 (high): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in…
• CVE-2025-69227 — CVSS 7.5 (high): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to…
• CVE-2024-30251 — CVSS 7.5 (high): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially…
• CVE-2024-52304 — CVSS 7.5 (high): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines…
• CVE-2025-53643 — CVSS 7.5 (high): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable…
• CVE-2023-49081 — CVSS 7.2 (high): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to…
• CVE-2023-28859 — CVSS 6.5 (medium): redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and…
• CVE-2025-69224 — CVSS 6.5 (medium): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may…
• CVE-2024-27306 — CVSS 6.1 (medium): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file…
• CVE-2025-69229 — CVSS 5.3 (medium): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages…
• CVE-2025-69225 — CVSS 5.3 (medium): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows…
• CVE-2025-69226 — CVSS 5.3 (medium): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain…
• CVE-2024-42367 — CVSS 4.8 (medium): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2…
• CVE-2023-28858 — CVSS 3.7 (low): redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to…
• CVE-2023-47641 — CVSS 3.4 (low): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability…
• CVE-2021-21330 — CVSS 3.1 (low): aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect…