Description of the patch:
This update for python-aiohttp fixes the following issues
- CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of
service (bsc#1261320).
- CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service (bsc#1261321).
- CVE-2026-34514:
content_type parameter manipulation can lead to header injection (bsc#1261322).
- CVE-2026-34516: response with excessive multipart headers can use more memory than intended and cause a denial of
service (bsc#1261329).
- CVE-2026-34517: large multipart form fields read into memory without size check can cause a denial of service
(bsc#1261331).
- CVE-2026-34518: retained
Cookie and Proxy-Authorization headers when following redirects can lead to information
disclosure (bsc#1261332).
- CVE-2026-34519: response
reason parameter can be use to perform header injection (bsc#1261334).
- CVE-2026-34520: improper character handling by C parser can lead to header injection (bsc#1261335).
- CVE-2026-34525: multiple
Host headers allow for potential security bypass in proxy servers (bsc#1261343).
- CVE-2026-34993: loading untrusted input in
CookieJar.load() can lead to arbitrary code execution (bsc#1267471).
- CVE-2026-47265: cookies set with the
cookies parameter on requests are sent after following a cross-origin redirect
and can leak sensitive data (bsc#1267561).
- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers
(bsc#1268398).
- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption
(bsc#1268543).
- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive
resource consumption (bsc#1268544).
- CVE-2026-54275:
server_hostname TLS SNI check bypass when an existing connection is reused (bsc#1268549).
- CVE-2026-54277:...