Bug 2484099 (CVE-2026-34993)

Summary: CVE-2026-34993 aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: adudiak, alinfoot, anpicker, anthomas, aprice, aruklets, bbrownin, bdettelb, brasmith, cahl, cmyers, cochase, dfreiber, dnakabaa, doconnor, dranck, drow, dschmidt, dtrifiro, ebourniv, ehelms, erezende, ggainey, gtanzill, hasun, ilpinto, jburrell, jbuscemi, jdobes, jfula, jkoehler, jlanda, jmitchel, jowilson, jpasqual, jsamir, juwatts, jwong, kaycoth, kshier, lbrazdil, lcouzens, lgallett, lichen, ljawale, lphiri, ltomasbo, luizcosta, mbarnett, mdellweg, mhulan, mminar, msilmser, nmoumoul, nweather, nyancey, oezr, omaciel, ometelka, orabin, osousa, pakotvan, pcreech, ptisnovs, rbiba, rbobbitt, rbryant, rchan, rjohnson, sbunciak, simaishi, smallamp, smcdonal, sskracic, stcannon, sthirugn, syedriko, teagle, tmalecek, tpfromme, ttakamiy, vkumar, weaton, xdharmai, xialiu, yguenane, ykashtan, zzhou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system. This issue is most likely to occur in applications that allow attacker-controlled files to be loaded.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2511059, 2511060    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-02 20:01:35 UTC
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.

Comment 5 errata-xmlrpc 2026-08-04 17:57:22 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2026:50319 https://access.redhat.com/errata/RHSA-2026:50319

Comment 6 errata-xmlrpc 2026-08-04 18:43:53 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:50336 https://access.redhat.com/errata/RHSA-2026:50336

Comment 8 errata-xmlrpc 2026-08-24 16:25:47 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2026:59135 https://access.redhat.com/errata/RHSA-2026:59135

Comment 9 errata-xmlrpc 2026-08-24 16:27:21 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:59136 https://access.redhat.com/errata/RHSA-2026:59136

Comment 11 errata-xmlrpc 2026-09-03 22:01:32 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.18 for RHEL 9

Via RHSA-2026:63386 https://access.redhat.com/errata/RHSA-2026:63386

Comment 12 errata-xmlrpc 2026-09-03 22:57:08 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:63387 https://access.redhat.com/errata/RHSA-2026:63387

Comment 13 errata-xmlrpc 2026-09-03 22:58:20 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:63327 https://access.redhat.com/errata/RHSA-2026:63327