Bug 2484099 (CVE-2026-34993)
| Summary: | CVE-2026-34993 aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | adudiak, alinfoot, anpicker, anthomas, aprice, aruklets, bbrownin, bdettelb, brasmith, cahl, cmyers, cochase, dfreiber, dnakabaa, doconnor, dranck, drow, dschmidt, dtrifiro, ebourniv, ehelms, erezende, ggainey, gtanzill, hasun, ilpinto, jburrell, jbuscemi, jdobes, jfula, jkoehler, jlanda, jmitchel, jowilson, jpasqual, jsamir, juwatts, jwong, kaycoth, kshier, lbrazdil, lcouzens, lgallett, lichen, ljawale, lphiri, ltomasbo, luizcosta, mbarnett, mdellweg, mhulan, mminar, msilmser, nmoumoul, nweather, nyancey, oezr, omaciel, ometelka, orabin, osousa, pakotvan, pcreech, ptisnovs, rbiba, rbobbitt, rbryant, rchan, rjohnson, sbunciak, simaishi, smallamp, smcdonal, sskracic, stcannon, sthirugn, syedriko, teagle, tmalecek, tpfromme, ttakamiy, vkumar, weaton, xdharmai, xialiu, yguenane, ykashtan, zzhou |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system. This issue is most likely to occur in applications that allow attacker-controlled files to be loaded.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2511059, 2511060 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-06-02 20:01:35 UTC
This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Via RHSA-2026:50319 https://access.redhat.com/errata/RHSA-2026:50319 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.6 for RHEL 9 Red Hat Ansible Automation Platform 2.6 for RHEL 10 Via RHSA-2026:50336 https://access.redhat.com/errata/RHSA-2026:50336 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Via RHSA-2026:59135 https://access.redhat.com/errata/RHSA-2026:59135 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.6 for RHEL 9 Red Hat Ansible Automation Platform 2.6 for RHEL 10 Via RHSA-2026:59136 https://access.redhat.com/errata/RHSA-2026:59136 This issue has been addressed in the following products: Red Hat Satellite 6.18 for RHEL 9 Via RHSA-2026:63386 https://access.redhat.com/errata/RHSA-2026:63386 This issue has been addressed in the following products: Red Hat Satellite 6.17 for RHEL 9 Via RHSA-2026:63387 https://access.redhat.com/errata/RHSA-2026:63387 This issue has been addressed in the following products: Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9 Via RHSA-2026:63327 https://access.redhat.com/errata/RHSA-2026:63327 |