{
  "@id": "urn:uuid:b24c687d-cb91-45f6-9aee-70e088a7c1fa",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-09-30T05:27:00.082647+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2023-49081"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2023-49082"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2024-23334"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2024-23829"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2024-27306"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2024-30251"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2025-53643"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2025-69223"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2025-69224"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2025-69225"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2025-69226"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2025-69227"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2025-69228"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2025-69229"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post14+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-69230"
      },
      "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-22815"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-34513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-34514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-34515"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-34516"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-34517"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-34518"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-34519"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-34520"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-34525"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-34993"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-47265"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-50269"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-54273"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-54274"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post14+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54275"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post14+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54276"
      },
      "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-54277"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-54278"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-54279"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post14+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54280"
      },
      "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-59881"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-69243"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post14+tuxcare of aiohttp.",
      "vulnerability": {
        "name": "CVE-2026-69244"
      }
    }
  ]
}