{"vulnerability": "cve-2026-6924", "sightings": [{"uuid": "2ef08a7f-32a7-4a6d-980c-c1c0fd1dd6b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "seen", "source": "https://gist.github.com/alon710/b3523524be79c42fa548f91ed3953ea3", "content": "# CVE-2026-69243: CVE-2026-69243: HTTP Request Smuggling via WebSocket Upgrade State Desynchronization in aiohttp\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69243\n\n## Summary\nAn asynchronous HTTP client/server framework for asyncio and Python, aiohttp prior to version 3.14.2 is vulnerable to HTTP Request Smuggling. The server-side HTTP parser immediately transitions the protocol state to 'upgraded' upon receiving a WebSocket upgrade request before consuming the accompanying request body. If the backend handler rejects the upgrade request while keeping the TCP connection alive, the unconsumed request body remains in the socket buffer and is parsed as a subsequent pipelined HTTP request. This allows an attacker to smuggle requests, bypass frontend reverse proxy controls, and perform unauthorized actions.\n\n## TL;DR\nPrior to version 3.14.2, aiohttp transitions its protocol state to 'upgraded' before reading the body of a WebSocket upgrade request. If the handler rejects the upgrade, any unconsumed body bytes are parsed as a new pipelined HTTP request, enabling request smuggling.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS Vector**: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\n- **Exploit Status**: poc\n- **KEV Status**: No\n- **Affected Component**: HTTP Parser\n\n## Affected Systems\n\n- aiohttp asynchronous server component\n- **aiohttp**: < 3.14.2 (Fixed in: `3.14.2`)\n\n## Mitigation\n\n- Upgrade to aiohttp version 3.14.2 or higher.\n- Block WebSocket upgrade requests that contain a non-empty request body at the reverse proxy layer.\n- Disable HTTP keep-alive or connection reuse for routes handling WebSocket upgrades.\n\n**Remediation Steps:**\n1. Update standard requirements.txt or dependency lockfiles to require 'aiohttp>=3.14.2'.\n2. Deploy the updated application containers or server instances.\n3. Verify the implementation by sending a test pipelined connection to confirm unconsumed bodies are properly handled without request smuggling.\n\n## References\n\n- [GitHub Security Advisory GHSA-mfx4-hv73-q22v](https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v)\n- [Official Pull Request #13017](https://github.com/aio-libs/aiohttp/pull/13017)\n- [Commit 6ae358f0983c3f4d6f67692b2f8e65dc8e091c98](https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98)\n- [Release v3.14.2](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69243)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69243) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T03:31:26.704466Z"}, {"uuid": "74d7cbd7-3889-4468-8e87-be7a6ecd862f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://gist.github.com/alon710/d6efe0abb614ef8ea563c1fdaaf1246b", "content": "# CVE-2026-69240: CVE-2026-69240: SQL Injection Vulnerability in Sequelize ORM Oracle Dialect\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69240\n\n## Summary\nA critical SQL injection vulnerability was discovered in Sequelize when configured to use the Oracle database dialect. Due to a flawed optimization design in the SQL escaping subsystem (src/sql-string.js), strings that begin with native Oracle date functions bypass standard escaping. This allows unauthenticated remote attackers to execute arbitrary SQL commands on the target database.\n\n## TL;DR\nSequelize versions prior to 6.37.4 fail to escape single quotes when string inputs start with TO_DATE or TO_TIMESTAMP, leading to critical SQL injection in applications using the Oracle dialect.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: None (UI:N)\n- **Impact**: Confidentiality, Integrity, Availability (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using Sequelize ORM with Oracle database backend\n- **sequelize**: < 6.37.4 (Fixed in: `6.37.4`)\n\n## Mitigation\n\n- Upgrade Sequelize to version 6.37.4 or later\n- Implement input sanitization rules to block TO_DATE and TO_TIMESTAMP prefixes\n- Use parameterized bind variables where possible to isolate data from commands\n\n**Remediation Steps:**\n1. Identify all service deployments using Sequelize with the Oracle database dialect.\n2. Update the package.json file to specify sequelize version ^6.37.4.\n3. Execute npm install or yarn install to apply the patch.\n4. Validate that all application tests pass and deploy the changes.\n\n## References\n\n- [GitHub Security Advisory GHSA-v8fg-2rw7-q452](https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452)\n- [Sequelize Release Note (v6.37.4)](https://github.com/sequelize/sequelize/releases/tag/v6.37.4)\n- [NVD CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69240)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69240) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T05:31:41.629580Z"}, {"uuid": "18e9175a-2c20-4900-b337-dce6a965c163", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69246", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117037876063346800", "content": "CVE-2026-69246 - Guzzle HTTP client mishandles Host header via libcurl IDNA/decoding, leading to request smuggling/SSRF. CVSS 7.2. No patch yet; upgrade when fixed. #CVE #PHP #infosec\nhttps://www.valtersit.com/cve/CVE-2026-69246/", "creation_timestamp": "2026-08-04T15:11:04.395143Z"}, {"uuid": "34dbadad-2e43-4a87-8774-9bd7e8acb2a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69246", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3msbcc3iwy52e", "content": "CVE-2026-69246 - Guzzle HTTP client mishandles Host header via libcurl IDNA/decoding, leading to request smuggling/SSRF. CVSS 7.2. No patch yet; upgrade when fixed. #CVE #PHP #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-69246/", "creation_timestamp": "2026-08-04T15:11:08.171345Z"}, {"uuid": "dda0bf56-eca4-4a9f-9083-7ff66730d8cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96645", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-69243-poc-aiohttp-smuggling\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JVBotelho\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Rust\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 19:53:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-05T00:00:21.592414Z"}, {"uuid": "16e079fc-0afd-4c66-86cd-3f75aabbc504", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96645", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-69243-poc-aiohttp-smuggling\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JVBotelho\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Rust\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 19:53:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-04T21:00:04.721322Z"}, {"uuid": "c9059df3-5425-4567-be08-4199ff9dca08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms7fkh4ivf2h", "content": "CVE-2026-69240 - sequelize\nSequelize, a database library, has a vulnerability that allows attackers to inject malicious SQL code when using the Oracle dialect. This can lead to data theft and tampering. To fix\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sequelize #npm #CVE #infosec", "creation_timestamp": "2026-08-03T21:04:04.896099Z"}, {"uuid": "66b67c2a-36a2-433b-ae96-c21307aa78b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69244", "type": "seen", "source": "https://gist.github.com/alon710/cb22e8e296a36049522556dbfd0c36bc", "content": "# CVE-2026-69244: CVE-2026-69244: Heap Out-of-Bounds Read in aiohttp C-Parser Error Handling\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69244\n\n## Summary\nA high-severity heap-based out-of-bounds (OOB) read vulnerability exists in the Cython-based HTTP response and request parser extension of aiohttp. When processing malformed HTTP traffic, the parser fails to properly handle raw C pointers returned by the underlying llhttp library during error-message construction. This triggers an uncontrolled strlen() call on non-null-terminated network buffers, which can result in a Denial of Service (DoS) via worker process crash or the exposure of adjacent heap memory inside exception messages.\n\n## TL;DR\nA heap out-of-bounds read in the C-parser of aiohttp allows unauthenticated remote attackers to crash application processes or leak adjacent heap memory by sending specially crafted malformed HTTP requests or responses.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-125\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 7.1\n- **EPSS Score**: Not Available\n- **Vulnerability Class**: Heap Out-of-Bounds Read\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- aiohttp client-side applications running on versions prior to 3.14.3 with C extensions enabled\n- aiohttp server-side applications running on versions prior to 3.14.3 with C extensions enabled\n- **aiohttp**: < 3.14.3 (Fixed in: `3.14.3`)\n\n## Mitigation\n\n- Upgrade aiohttp to version 3.14.3 or later to apply the safe integer-offset parsing logic.\n- Disable compiled C extensions by setting AIOHTTP_NO_EXTENSIONS=1 to force the safe pure-Python parser fallback.\n- Implement edge web application firewalls (WAF) to block malformed chunked transfer encoding payloads before they reach backend application servers.\n\n**Remediation Steps:**\n1. Identify all python environments, Dockerfiles, and requirements.txt files specifying aiohttp.\n2. Run 'pip install -U aiohttp>=3.14.3' to apply the official vendor patch.\n3. In legacy environments, add 'ENV AIOHTTP_NO_EXTENSIONS=1' to the container Dockerfile as a temporary hotfix.\n4. Restart all affected application worker processes and monitor container crash logs for exit code 139 (SIGSEGV).\n\n## References\n\n- [GitHub Security Advisory GHSA-cq5v-8q36-5273](https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273)\n- [CVE-2026-69244 Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69244)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69244) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T21:32:44.870700Z"}, {"uuid": "1b133c9f-37c7-415d-bfc3-9662e5baf38f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7iowh6z32g", "content": "\ud83d\udd34 CVE-2026-69240 - Critical (9.8)\n\nSequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-69240/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-03T22:00:16.757740Z"}, {"uuid": "40e86982-6d7f-4c83-80b4-eb8f5b27efdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69248", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ecmrxfdhpjgt4", "content": "CVE-2026-69248 - python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees\nCVE ID : CVE-2026-69248\n \n Published : Aug. 3, 2026, 9:21 p.m. | 37\u00a0minutes ago\n \n Description : cryptography is a package designed to expose cryptographic primitive...", "creation_timestamp": "2026-08-03T22:08:16.733765Z"}, {"uuid": "750c8fa4-4a62-4d3e-8eb6-e03d783eb475", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69249", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/g2utxha3ngw7m", "content": "CVE-2026-69249 - python-cryptography: Duplicate self-signed intermediates can cause exponential path-building\nCVE ID : CVE-2026-69249\n \n Published : Aug. 3, 2026, 9:26 p.m. | 32\u00a0minutes ago\n \n Description : python-cryptography is a package designed to expose cryptographic prim...", "creation_timestamp": "2026-08-03T22:20:16.911549Z"}, {"uuid": "70f522ff-9958-4513-9d5a-6b0208db1c51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69248", "type": "seen", "source": "https://gist.github.com/alon710/ab6ab460d039209b756930fd867ab75f", "content": "# CVE-2026-69248: CVE-2026-69248: Name Constraints Bypass via Wildcard SANs in Python cryptography\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69248\n\n## Summary\nAn improper certificate validation vulnerability (CWE-295) in the Rust-based X.509 verification engine of python-cryptography allows wildcard Subject Alternative Names (SANs) to bypass permitted Name Constraints. This enables an attacker to construct certificates that escape the restricted scope of a subordinate Certificate Authority (CA) and successfully authenticate against vulnerable client installations. The vulnerability is tracked as CVE-2026-69248 and GHSA-m2h6-j472-rp4c, with a CVSS v4.0 base score of 6.9.\n\n## TL;DR\nA flaw in python-cryptography's Rust-based X.509 verifier allows a wildcard SAN (e.g., `*.example.com`) to satisfy a restricted permitted Name Constraint (e.g., `foo.example.com`), enabling subordinate CA scope escape.\n\n## Technical Details\n\n- **CWE ID**: CWE-295\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.9 (Medium)\n- **EPSS Score**: Not yet indexed\n- **Impact**: High (Complete Bypass of Certificate-Based Trust Boundaries)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- python-cryptography (cryptography-x509-verification crate)\n- **cryptography**: < 49.0.0 (Fixed in: `49.0.0`)\n\n## Mitigation\n\n- Upgrade python-cryptography to version 49.0.0 or higher.\n- Audit active certificates in the PKI to identify wildcard SANs issued by restricted sub-CAs.\n- Implement validation-layer checks in Python code to enforce minimum library versions.\n\n**Remediation Steps:**\n1. Identify all virtual environments and containers running python-cryptography.\n2. Execute the upgrade command: pip install --upgrade \"cryptography>=49.0.0\".\n3. Re-deploy applications and verify that the active library version is at least 49.0.0.\n4. Validate certificate issuance policies to ensure sub-CAs cannot sign wildcard certificates that violate constraints.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69248) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T22:31:31.236955Z"}, {"uuid": "7ffdd3c4-779e-47db-9a29-7beb157da053", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69248", "type": "published-proof-of-concept", "source": "https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c", "content": "", "creation_timestamp": "2026-08-03T22:35:04.478372Z"}, {"uuid": "c147f25e-993c-4a08-aeeb-976b3084243b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69249", "type": "published-proof-of-concept", "source": "https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww", "content": "", "creation_timestamp": "2026-08-03T22:35:06.671267Z"}, {"uuid": "7cdee7c6-5443-4c46-9cc7-57ba646a8b26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69240", "type": "published-proof-of-concept", "source": "https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452", "content": "", "creation_timestamp": "2026-08-03T22:35:08.866721Z"}, {"uuid": "9f60dafc-2faa-44cf-ada7-cdac891dc16d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69249", "type": "seen", "source": "https://gist.github.com/alon710/5ac467a3d50f6bfb29b3f3cc3d2c5925", "content": "# CVE-2026-69249: CVE-2026-69249: Exponential Backtracking Denial of Service in python-cryptography X.509 Verification Engine\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69249\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-400) exists in the python-cryptography library's Rust-based X.509 verification engine. The flaw allows unauthenticated remote attackers to trigger severe CPU exhaustion and Denial of Service (DoS) by supplying specially crafted certificate chains containing duplicate self-signed certificates, forcing the recursive path builder into an exponential state-search loop.\n\n## TL;DR\nUnauthenticated remote attackers can cause complete CPU exhaustion and Denial of Service (DoS) on endpoints using python-cryptography by submitting malformed certificate chains containing duplicate self-signed intermediates, triggering an exponential path-building backtracking loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7 (High)\n- **Impact**: Denial of Service (DoS) via CPU Exhaustion\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed on CISA KEV\n\n## Affected Systems\n\n- Python environments utilizing the cryptography package version < 49.0.0\n- Application servers implementing custom X.509 chain building or client certificate verification using PolicyBuilder\n- S/MIME and client-authenticated TLS validation gateways relying on the pyca/cryptography engine\n- **cryptography**: < 49.0.0 (Fixed in: `49.0.0`)\n\n## Mitigation\n\n- Upgrade the python-cryptography dependency to version 49.0.0 or higher immediately.\n- Implement a request size and certificate chain length limit at the ingress reverse proxy or API gateway.\n- Enforce execution timeouts on tasks processing untrusted certificate parsing and validation.\n\n**Remediation Steps:**\n1. Identify all Python execution environments and virtualenvs running python-cryptography.\n2. Run the pip install upgrade command: `pip install --upgrade cryptography>=49.0.0`.\n3. Validate the installed version using: `python3 -c \"import cryptography; print(cryptography.__version__)\"`.\n4. Restart any daemonized processes or application servers to reload the patched native library binaries.\n\n## References\n\n- [GHSA-jwv3-5hgf-82ww: Path validation algorithmic complexity vulnerability](https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww)\n- [Fix Commit 4a12cf49675a184e47f912b00b04f3a629283582](https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582)\n- [Authoritative CVE-2026-69249 Record](https://www.cve.org/CVERecord?id=CVE-2026-69249)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69249) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T23:31:38.811141Z"}, {"uuid": "18494c72-ad9f-43c8-89b5-33b850f08b1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69248", "type": "seen", "source": "https://gist.github.com/alon710/ab6ab460d039209b756930fd867ab75f", "content": "# CVE-2026-69248: CVE-2026-69248: Name Constraints Bypass via Wildcard SANs in Python cryptography\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69248\n\n## Summary\nAn improper certificate validation vulnerability (CWE-295) in the Rust-based X.509 verification engine of python-cryptography allows wildcard Subject Alternative Names (SANs) to bypass permitted Name Constraints. This enables an attacker to construct certificates that escape the restricted scope of a subordinate Certificate Authority (CA) and successfully authenticate against vulnerable client installations. The vulnerability is tracked as CVE-2026-69248 and GHSA-m2h6-j472-rp4c, with a CVSS v4.0 base score of 6.9.\n\n## TL;DR\nA flaw in python-cryptography's Rust-based X.509 verifier allows a wildcard SAN (e.g., `*.example.com`) to satisfy a restricted permitted Name Constraint (e.g., `foo.example.com`), enabling subordinate CA scope escape.\n\n## Technical Details\n\n- **CWE ID**: CWE-295\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.9 (Medium)\n- **EPSS Score**: Not yet indexed\n- **Impact**: High (Complete Bypass of Certificate-Based Trust Boundaries)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- python-cryptography (cryptography-x509-verification crate)\n- **cryptography**: < 49.0.0 (Fixed in: `49.0.0`)\n\n## Mitigation\n\n- Upgrade python-cryptography to version 49.0.0 or higher.\n- Audit active certificates in the PKI to identify wildcard SANs issued by restricted sub-CAs.\n- Implement validation-layer checks in Python code to enforce minimum library versions.\n\n**Remediation Steps:**\n1. Identify all virtual environments and containers running python-cryptography.\n2. Execute the upgrade command: pip install --upgrade \"cryptography>=49.0.0\".\n3. Re-deploy applications and verify that the active library version is at least 49.0.0.\n4. Validate certificate issuance policies to ensure sub-CAs cannot sign wildcard certificates that violate constraints.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69248) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T00:00:43.607882Z"}, {"uuid": "4bbad302-19c6-45a2-97e6-f862ee757388", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69249", "type": "seen", "source": "https://gist.github.com/alon710/5ac467a3d50f6bfb29b3f3cc3d2c5925", "content": "# CVE-2026-69249: CVE-2026-69249: Exponential Backtracking Denial of Service in python-cryptography X.509 Verification Engine\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69249\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-400) exists in the python-cryptography library's Rust-based X.509 verification engine. The flaw allows unauthenticated remote attackers to trigger severe CPU exhaustion and Denial of Service (DoS) by supplying specially crafted certificate chains containing duplicate self-signed certificates, forcing the recursive path builder into an exponential state-search loop.\n\n## TL;DR\nUnauthenticated remote attackers can cause complete CPU exhaustion and Denial of Service (DoS) on endpoints using python-cryptography by submitting malformed certificate chains containing duplicate self-signed intermediates, triggering an exponential path-building backtracking loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7 (High)\n- **Impact**: Denial of Service (DoS) via CPU Exhaustion\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed on CISA KEV\n\n## Affected Systems\n\n- Python environments utilizing the cryptography package version < 49.0.0\n- Application servers implementing custom X.509 chain building or client certificate verification using PolicyBuilder\n- S/MIME and client-authenticated TLS validation gateways relying on the pyca/cryptography engine\n- **cryptography**: < 49.0.0 (Fixed in: `49.0.0`)\n\n## Mitigation\n\n- Upgrade the python-cryptography dependency to version 49.0.0 or higher immediately.\n- Implement a request size and certificate chain length limit at the ingress reverse proxy or API gateway.\n- Enforce execution timeouts on tasks processing untrusted certificate parsing and validation.\n\n**Remediation Steps:**\n1. Identify all Python execution environments and virtualenvs running python-cryptography.\n2. Run the pip install upgrade command: `pip install --upgrade cryptography>=49.0.0`.\n3. Validate the installed version using: `python3 -c \"import cryptography; print(cryptography.__version__)\"`.\n4. Restart any daemonized processes or application servers to reload the patched native library binaries.\n\n## References\n\n- [GHSA-jwv3-5hgf-82ww: Path validation algorithmic complexity vulnerability](https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww)\n- [Fix Commit 4a12cf49675a184e47f912b00b04f3a629283582](https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582)\n- [Authoritative CVE-2026-69249 Record](https://www.cve.org/CVERecord?id=CVE-2026-69249)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69249) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T00:00:43.516266Z"}, {"uuid": "eec67f2e-ba85-46f6-941f-511fcb268213", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69247", "type": "seen", "source": "https://gist.github.com/alon710/aae79fe7bcf7e7234c2912679ec8c451", "content": "# CVE-2026-69247: CVE-2026-69247: Bleichenbacher Oracle in pyca/cryptography PKCS#7 Decryption\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69247\n\n## Summary\nA side-channel vulnerability in pyca/cryptography (versions 44.0.0 through 49.9.9) allows unauthenticated remote attackers to expose a Bleichenbacher oracle. This flaw exists within the PKCS#7 decryption module (specifically pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime) during Content Encryption Key (CEK) decryption when using RSA PKCS#1 v1.5 padding. Differences in error classification and symmetric execution timing allow an attacker to reconstruct plaintext keys.\n\n## TL;DR\nA Bleichenbacher side-channel timing and error oracle in pyca/cryptography before version 50.0.0 allows unauthenticated remote attackers to recover Content Encryption Keys (CEK) and decrypt sensitive S/MIME messages by submitting crafted PKCS#7 ciphertexts and observing decryption responses.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-208: Observable Timing Discrepancy\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.2 (High)\n- **Exploit Status**: Proof of concept code exists in library test suites; no public weaponized exploits.\n- **CISA KEV Status**: Not listed\n- **Mitigation Standard**: RFC 3218 (Key substitution on failure)\n- **Affected Functionality**: pkcs7_decrypt_der, pkcs7_decrypt_pem, pkcs7_decrypt_smime\n\n## Affected Systems\n\n- pyca/cryptography Python libraries (versions 44.0.0 through 49.9.9)\n- S/MIME processing gateways relying on affected cryptography versions\n- Email processing filters and document ingestion pipelines handling PKCS#7 EnvelopedData\n- **cryptography**: >= 44.0.0, < 50.0.0 (Fixed in: `50.0.0`)\n\n## Mitigation\n\n- Upgrade the pyca/cryptography package to version 50.0.0 or higher.\n- Design S/MIME and mail-processing applications to handle decryption asynchronously in background queues with uniform execution times.\n- Sanitize application error messages to ensure that decryption failures always return a generic error code without leaking padding or size metrics.\n- Implement strict rate-limiting on endpoints that accept and decrypt encrypted PKCS#7 payloads.\n\n**Remediation Steps:**\n1. Identify all Python execution environments and containerized applications utilizing the pyca/cryptography library.\n2. Execute `pip install --upgrade cryptography>=50.0.0` in your deployment pipelines and update requirements.txt/poetry.lock files.\n3. Re-build and redeploy application containers to integrate the updated binary wheel.\n4. Review application-level error handlers to verify that ValueError exceptions from pkcs7_decrypt functions are caught and mapped to unified, safe error responses.\n\n## References\n\n- [GitHub Security Advisory GHSA-g6cj-pr64-35w5](https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5)\n- [Fix Commit 53fccd93](https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f)\n- [GitHub Pull Request 15369](https://github.com/pyca/cryptography/pull/15369)\n- [CVE-2026-69247 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-69247)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69247) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T00:32:44.766086Z"}, {"uuid": "73fd7c6c-8662-4211-ad4b-26c3543c612b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69246", "type": "seen", "source": "https://gist.github.com/alon710/aa0d8e0a2033bd155210db761c2f4b38", "content": "# CVE-2026-69246: CVE-2026-69246: Host Validation Bypass in Guzzle HTTP Client Leading to SSRF\n\n> **CVSS Score:** 7.2\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69246\n\n## Summary\nCVE-2026-69246 is a host validation bypass vulnerability in the Guzzle PHP HTTP client. The flaw resides in Guzzle's core HTTP transport handlers (cURL and PHP stream wrappers). Under specific conditions, a parser differential occurs between the host validation layer and the underlying network transport library (e.g., libcurl), allowing remote attackers to bypass SSRF filters, proxy routing rules, and redirect protections via crafted noncanonical URI representations.\n\n## TL;DR\nHost validation bypass in Guzzle allows SSRF and proxy routing bypass by exploiting differences in how Guzzle and underlying transport libraries parse noncanonical URI hostnames.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-436 (Interpretation Conflict)\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.2 (High)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n- **Impact**: Server-Side Request Forgery (SSRF) / Information Disclosure\n\n## Affected Systems\n\n- Guzzle HTTP Client < 7.15.2\n- Guzzle HTTP Client 8.0.0\n- **Guzzle**: < 7.15.2 (Fixed in: `7.15.2`)\n- **Guzzle**: >= 8.0.0, < 8.0.1 (Fixed in: `8.0.1`)\n\n## Mitigation\n\n- Upgrade Guzzle to version 7.15.2 or 8.0.1 to activate the HostValidator mechanism.\n- Perform active DNS resolution on target URLs within application logic before passing them to the HTTP client.\n- Validate resolved target IP addresses using PHP's native FILTER_VALIDATE_IP with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE.\n\n**Remediation Steps:**\n1. Identify all Composer dependencies matching guzzlehttp/guzzle.\n2. Execute the update command: composer update guzzlehttp/guzzle.\n3. Verify the installed version is either >= 7.15.2 or >= 8.0.1.\n4. Deploy code modifications to enforce DNS resolution validation on custom webhook and SSRF-sensitive endpoints.\n\n## References\n\n- [GHSA-v5mv-p594-2x33](https://github.com/guzzle/guzzle/security/advisories/GHSA-v5mv-p594-2x33)\n- [Guzzle Pull Request 3907](https://github.com/guzzle/guzzle/pull/3907)\n- [Guzzle Pull Request 3908](https://github.com/guzzle/guzzle/pull/3908)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69246) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T01:31:43.563239Z"}, {"uuid": "8e17d5a7-48e5-484b-99f4-6236f721c076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69245", "type": "seen", "source": "https://gist.github.com/alon710/4e720b413fb9ae4a89b2607de953bdbe", "content": "# CVE-2026-69245: CVE-2026-69245: Noncanonical Cookie Domain Keeps Subdomain Scope in Guzzle\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69245\n\n## Summary\nA vulnerability in the Guzzle HTTP client allows session identifiers, auth tokens, or cookies to be leaked to unauthorized hosts due to incorrect cookie domain validation of noncanonical IPv4 host formats. Guzzle failed to recognize octal, hexadecimal, and percent-encoded IP addresses as IP literals, treating them as standard domains and incorrectly extending their scope to subdomains.\n\n## TL;DR\nGuzzle's cookie matching logic failed to identify noncanonical IPv4 host formats (like hexadecimal, octal, or percent-encoded) as IP literals, incorrectly applying standard suffix/subdomain matching and leaking sensitive cookies to attacker-controlled subdomains.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-180, CWE-346, CWE-384\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **CVSS Severity**: 6.5 Medium\n- **EPSS Score**: Not Available\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Guzzle (PHP HTTP Client)\n- **Guzzle**: < 7.15.2 (Fixed in: `7.15.2`)\n- **Guzzle**: >= 8.0.0, < 8.0.1 (Fixed in: `8.0.1`)\n\n## Mitigation\n\n- Upgrade Guzzle to version 7.15.2 or 8.0.1 and above.\n- Strictly validate and canonicalize input IP addresses using filter_var() before passing them to the HTTP client.\n- Implement WAF or proxy rules to detect and block noncanonical IP host formats (hexadecimal, octal, percent-encoded) in outbound requests.\n\n**Remediation Steps:**\n1. Identify all Guzzle installations within the dependency tree (composer.lock).\n2. Run 'composer update guzzlehttp/guzzle' to fetch the latest patched version.\n3. Verify the installed version is either >= 7.15.2 or >= 8.0.1.\n\n## References\n\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69245)\n- [GitHub Security Advisory](https://github.com/guzzle/guzzle/security/advisories/GHSA-f7vp-7xgx-4w4r)\n- [Guzzle 8.0.1 Patch Commit](https://github.com/guzzle/guzzle/commit/3aeea0406aab88cbbd86531313d7cebf8ae149a4)\n- [Guzzle 7.15.2 Patch Commit](https://github.com/guzzle/guzzle/commit/744101956d78b7c1384d0cbf379db13e859167bf)\n- [PR #3907 (7.15 Fixes)](https://github.com/guzzle/guzzle/pull/3907)\n- [PR #3908 (8.0 Fixes)](https://github.com/guzzle/guzzle/pull/3908)\n- [Guzzle 7.15.2 Release Notes](https://github.com/guzzle/guzzle/releases/tag/7.15.2)\n- [Guzzle 8.0.1 Release Notes](https://github.com/guzzle/guzzle/releases/tag/8.0.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69245) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T02:31:55.501348Z"}, {"uuid": "7f4240ed-020a-49a1-9454-2fde64568cab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "seen", "source": "Telegram/rJSqz12D-kpQyCOJVo_dGQ5YtXruuuT1_BANzgPusZ6YAnQ", "content": "", "creation_timestamp": "2026-08-05T01:00:03.566033Z"}, {"uuid": "298cc2d0-94e7-4c02-bb89-d8cb89b4d86a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3367", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0430\u0440\u0441\u0435\u0440\u0430 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 aiohttp \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\nBDU:2026-11139\nCVE-2026-69243\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98", "creation_timestamp": "2026-08-08T00:06:19.946314Z"}, {"uuid": "5ca15b01-e29b-4024-9541-8b541e17f29e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "published-proof-of-concept", "source": "Telegram/rJSqz12D-kpQyCOJVo_dGQ5YtXruuuT1_BANzgPusZ6YAnQ", "content": "", "creation_timestamp": "2026-08-06T00:01:00.789029Z"}, {"uuid": "edab4b06-1ac2-4016-ac1c-6d2cd2cb5f7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69243", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3367", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0430\u0440\u0441\u0435\u0440\u0430 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 aiohttp \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\nBDU:2026-11139\nCVE-2026-69243\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98", "creation_timestamp": "2026-08-07T14:02:14.203218Z"}]}