{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-aiohttp",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-aiohttp fixes the following issues\n\n- CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320).\n- CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321).\n- CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322).\n- CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329).\n- CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331).\n- CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure\n  (bsc#1261332).\n- CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334).\n- CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335).\n- CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343).\n- CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471).\n- CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect\n  (bsc#1267561).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-963",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22173-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22173-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622173-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22173-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026918.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261320",
        "url": "https://bugzilla.suse.com/1261320"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261321",
        "url": "https://bugzilla.suse.com/1261321"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261322",
        "url": "https://bugzilla.suse.com/1261322"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261329",
        "url": "https://bugzilla.suse.com/1261329"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261331",
        "url": "https://bugzilla.suse.com/1261331"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261332",
        "url": "https://bugzilla.suse.com/1261332"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261334",
        "url": "https://bugzilla.suse.com/1261334"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261335",
        "url": "https://bugzilla.suse.com/1261335"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261343",
        "url": "https://bugzilla.suse.com/1261343"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267471",
        "url": "https://bugzilla.suse.com/1267471"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267561",
        "url": "https://bugzilla.suse.com/1267561"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-22815 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-22815/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34513 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34513/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34514 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34514/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34516 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34516/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34517 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34517/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34518 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34518/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34519 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34519/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34520 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34520/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34525 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34525/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34993 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34993/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-47265 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-47265/"
      }
    ],
    "title": "Security update for python-aiohttp",
    "tracking": {
      "current_release_date": "2026-06-19T07:54:42Z",
      "generator": {
        "date": "2026-06-19T07:54:42Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22173-1",
      "initial_release_date": "2026-06-19T07:54:42Z",
      "revision_history": [
        {
          "date": "2026-06-19T07:54:42Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.5.1.aarch64",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.5.1.aarch64",
                  "product_id": "python313-aiohttp-3.11.16-160000.5.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.5.1.ppc64le",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.5.1.ppc64le",
                  "product_id": "python313-aiohttp-3.11.16-160000.5.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.5.1.s390x",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.5.1.s390x",
                  "product_id": "python313-aiohttp-3.11.16-160000.5.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-aiohttp-3.11.16-160000.5.1.x86_64",
                "product": {
                  "name": "python313-aiohttp-3.11.16-160000.5.1.x86_64",
                  "product_id": "python313-aiohttp-3.11.16-160000.5.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.5.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.5.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.5.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.5.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.5.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.5.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-aiohttp-3.11.16-160000.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        },
        "product_reference": "python313-aiohttp-3.11.16-160000.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-22815",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-22815"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-22815",
          "url": "https://www.suse.com/security/cve/CVE-2026-22815"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261320 for CVE-2026-22815",
          "url": "https://bugzilla.suse.com/1261320"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-19T07:54:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-22815"
    },
    {
      "cve": "CVE-2026-34513",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34513"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34513",
          "url": "https://www.suse.com/security/cve/CVE-2026-34513"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261321 for CVE-2026-34513",
          "url": "https://bugzilla.suse.com/1261321"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-19T07:54:42Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-34513"
    },
    {
      "cve": "CVE-2026-34514",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34514"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34514",
          "url": "https://www.suse.com/security/cve/CVE-2026-34514"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261322 for CVE-2026-34514",
          "url": "https://bugzilla.suse.com/1261322"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-19T07:54:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34514"
    },
    {
      "cve": "CVE-2026-34516",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34516"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34516",
          "url": "https://www.suse.com/security/cve/CVE-2026-34516"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261329 for CVE-2026-34516",
          "url": "https://bugzilla.suse.com/1261329"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-19T07:54:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34516"
    },
    {
      "cve": "CVE-2026-34517",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34517"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34517",
          "url": "https://www.suse.com/security/cve/CVE-2026-34517"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261331 for CVE-2026-34517",
          "url": "https://bugzilla.suse.com/1261331"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-19T07:54:42Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-34517"
    },
    {
      "cve": "CVE-2026-34518",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34518"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34518",
          "url": "https://www.suse.com/security/cve/CVE-2026-34518"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261332 for CVE-2026-34518",
          "url": "https://bugzilla.suse.com/1261332"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-19T07:54:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34518"
    },
    {
      "cve": "CVE-2026-34519",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34519"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34519",
          "url": "https://www.suse.com/security/cve/CVE-2026-34519"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261334 for CVE-2026-34519",
          "url": "https://bugzilla.suse.com/1261334"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-19T07:54:42Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-34519"
    },
    {
      "cve": "CVE-2026-34520",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34520"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34520",
          "url": "https://www.suse.com/security/cve/CVE-2026-34520"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261335 for CVE-2026-34520",
          "url": "https://bugzilla.suse.com/1261335"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-19T07:54:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34520"
    },
    {
      "cve": "CVE-2026-34525",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34525"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34525",
          "url": "https://www.suse.com/security/cve/CVE-2026-34525"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261343 for CVE-2026-34525",
          "url": "https://bugzilla.suse.com/1261343"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-19T07:54:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34525"
    },
    {
      "cve": "CVE-2026-34993",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34993"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user\u0027s own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34993",
          "url": "https://www.suse.com/security/cve/CVE-2026-34993"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267471 for CVE-2026-34993",
          "url": "https://bugzilla.suse.com/1267471"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-19T07:54:42Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34993"
    },
    {
      "cve": "CVE-2026-47265",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-47265"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-47265",
          "url": "https://www.suse.com/security/cve/CVE-2026-47265"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267561 for CVE-2026-47265",
          "url": "https://bugzilla.suse.com/1267561"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-aiohttp-3.11.16-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-19T07:54:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-47265"
    }
  ]
}