Re: [meta-python][wrynose][PATCH 0/3] python3-aiohttp: fix multiple CVEs

["Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" <dkelaiya@cisco.com>]

[-- Attachment #1: Type: text/plain, Size: 2261 bytes --]

Hello Anuj,

I noticed that the aiohttp series has been picked up in your
anujm/wrynose contrib branch, but the prerequisite fix for
CVE-2026-54273 is missing.

As noted in the cover letter below, the series depends on that patch
for the HTTP parser queue-limit changes and recipe-time Cython
regeneration.

Could you please check the prerequisite patch [1] ( https://patchwork.yoctoproject.org/project/oe/patch/20260928174806.1818191-1-dkelaiya@cisco.com/ ) before this series?

[1] https://patchwork.yoctoproject.org/project/oe/patch/20260928174806.1818191-1-dkelaiya@cisco.com/

Thanks,
Darsh

On Fri, Oct 16, 2026 at 12:12 PM, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:

> 
> From: Darsh Kelaiya <dkelaiya@cisco.com>
> 
> Backport three upstream aiohttp security fixes to the 3.13.5 recipe
> on wrynose: CVE-2026-59881, CVE-2026-69243, and CVE-2026-69244.
> 
> The series fixes WebSocket compression handling, rejected WebSocket
> upgrade request-body parsing, and bounded error messages in the C
> HTTP parser.
> The individual commits retain upstream fix and advisory references.
> 
> This series depends on the previously submitted Wrynose fix for
> CVE-2026-54273, which has not merged yet. Apply that patch [1] before
> this series. It provides the HTTP parser queue-limit changes and
> recipe-time Cython regeneration used by these backports.
> 
> [1] https://patchwork.yoctoproject.org/project/oe/patch/20260928174806.1818191-1-dkelaiya@cisco.com/
> 
> 
> Darsh Kelaiya (3):
> python3-aiohttp: fix CVE-2026-59881
> python3-aiohttp: fix CVE-2026-69243
> python3-aiohttp: fix CVE-2026-69244
> 
> .../python3-aiohttp/CVE-2026-59881.patch | 103 ++++++
> .../python3-aiohttp/CVE-2026-69243.patch | 307 ++++++++++++++++++
> .../python3-aiohttp/CVE-2026-69244.patch | 159 +++++++++
> .../python/python3-aiohttp_3.13.5.bb | 3 +
> 4 files changed, 572 insertions(+)
> create mode 100644
> meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-59881.patch
> create mode 100644
> meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-69243.patch
> create mode 100644
> meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-69244.patch
> 
> --
> 2.35.6

[-- Attachment #2: Type: text/html, Size: 2918 bytes --]