From 7489d887347110a24367ab86989ecdaec19f16d4 Mon Sep 17 00:00:00 2001 From: Darsh Kelaiya Date: Wed, 26 Aug 2026 00:16:09 -0700 Subject: [PATCH] python3-aiohttp: ignore CVE-2026-34515 Analysis: - The upstream advisory limits the issue to aiohttp applications running on Windows and identifies the affected and fixed versions [1]. - The advisory-selected upstream fix rejects absolute static resource paths, explicitly including UNC and Windows drive paths [2]. - NVD independently describes the issue as Windows-specific and records the same upstream commit as the patch [3]. - Hence ignoring the CVE for now. Reference: [1] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m [2] https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d [3] https://nvd.nist.gov/vuln/detail/CVE-2026-34515 Signed-off-by: Darsh Kelaiya Signed-off-by: Anuj Mittal --- meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb b/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb index 84a9f2e668..6f89a18b13 100644 --- a/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb +++ b/meta-python/recipes-devtools/python/python3-aiohttp_3.9.5.bb @@ -13,6 +13,8 @@ SRC_URI += "file://CVE-2024-52304.patch \ file://CVE-2025-69228.patch \ " +CVE_STATUS[CVE-2026-34515] = "not-applicable-platform: Vulnerability only affects applications running on Windows" + PYPI_PACKAGE = "aiohttp" inherit python_setuptools_build_meta pypi