Description of the patch:
This update for python-aiohttp fixes the following issues:
- CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers
(bsc#1268398).
- CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption
(bsc#1268543).
- CVE-2026-54274: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive
resource consumption (bsc#1268544).
- CVE-2026-54275:
server_hostname TLS SNI check bypass when an existing connection is reused (bsc#1268549).
- CVE-2026-54277:
max_line_size bypass when using the optimised C HTTP parser can lead to excessive resource
consumption (bsc#1268556).
- CVE-2026-54278: unread compressed request bodies can bypass
client_max_size during cleanup and cause a DoS
(bsc#1268559).
- CVE-2026-54279: host-only cookies become domain cookies after
CookieJar persistence (bsc#1268560).
- CVE-2026-54280: payload resources are not closed correctly when a client disconnects in the middle of a write and
can cause resource starvation (bsc#1268561).