VDB

GHSA-cq5v-8q36-5273

GHSA-cq5v-8q36-5273 PUBLISHED CVSS 7.099999904632568 HIGH

Record from GitHub Advisory Database · Published August 3, 2026

aiohttp is fixed in 3.14.3 (PyPI)

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
aiohttpPyPI3.14.3
kserveWolfi0.20.0-r7, 0.19.0-r5
lmcache-cuda-12.8Chainguard0.5.3-r0
py3-cassandra-medusaWolfi0.29.1-r1
dask-kubernetesChainguard2026.3.0-r11
py3-cassandra-medusaChainguard0.29.1-r1
open-webuiChainguard0.11.0-r6
airflow-3Chainguard3.3.1-r1, 3.3.0-r4
airflow-core-2Chainguard2.11.2-r6
py3.13-scanner-test-libraries-aiohttpChainguard0.0.1-r4
apache-beam-python-3.12-sdkChainguard2.75.0-r1
dask-kubernetesWolfi2026.3.0-r11

14 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0
7.099999904632568
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products

VendorProductVersions
wolfikserve0, 0
chainguardlmcache-cuda-12.80
wolfipy3-cassandra-medusa0
chainguarddask-kubernetes0
chainguardpy3-cassandra-medusa0
chainguardopen-webui0
chainguardairflow-30, 0
chainguardairflow-core-20
chainguardpy3.13-scanner-test-libraries-aiohttp0
chainguardapache-beam-python-3.12-sdk0
wolfidask-kubernetes0
chainguardtext-generation-inference0
chainguardapache-beam-python-3.13-sdk0
PyPIaiohttp0
chainguardtritonserver-backend-vllm-cuda-13.00
wolfiairflow-30
chainguardpuppygraph-python0
chainguardawx0
chainguardkserve-models-web-app0
chainguarddatahub-ingestion-fips0

…and 6 more

Timeline

  • Aug 3, 2026 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-cq5v-8q36-5273
vulnetix vdb fixes GHSA-cq5v-8q36-5273

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-cq5v-8q36-5273/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›