I noticed that the aiohttp series has been picked up in your
anujm/wrynose contrib branch, but the prerequisite fix for
CVE-2026-54273 is missing.
As noted in the cover letter below, the series depends on that patch
for the HTTP parser queue-limit changes and recipe-time Cython
regeneration.
Could you please check the prerequisite patch [1] before this series?
[1] https://patchwork.yoctoproject.org/project/oe/patch/20260928174806.1818191-1-dkelaiya@cisco.com/
Thanks,
Darsh
From: Darsh Kelaiya <dkelaiya@cisco.com>
Backport three upstream aiohttp security fixes to the 3.13.5 recipe
on wrynose: CVE-2026-59881, CVE-2026-69243, and CVE-2026-69244.
The series fixes WebSocket compression handling, rejected WebSocket
upgrade request-body parsing, and bounded error messages in the C
HTTP parser.
The individual commits retain upstream fix and advisory references.
This series depends on the previously submitted Wrynose fix for
CVE-2026-54273, which has not merged yet. Apply that patch [1] before
this series. It provides the HTTP parser queue-limit changes and
recipe-time Cython regeneration used by these backports.
[1] https://patchwork.yoctoproject.org/project/oe/patch/20260928174806.1818191-1-dkelaiya@cisco.com/
Darsh Kelaiya (3):
python3-aiohttp: fix CVE-2026-59881
python3-aiohttp: fix CVE-2026-69243
python3-aiohttp: fix CVE-2026-69244
.../python3-aiohttp/CVE-2026-59881.patch | 103 ++++++
.../python3-aiohttp/CVE-2026-69243.patch | 307 ++++++++++++++++++
.../python3-aiohttp/CVE-2026-69244.patch | 159 +++++++++
.../python/python3-aiohttp_3.13.5.bb | 3 +
4 files changed, 572 insertions(+)
create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-59881.patch
create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-69243.patch
create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-69244.patch
--
2.35.6