[Aikido] Fix 1 critical issue in anyio and 41 other issues

[aikido-autofix]

Upgrade dependencies to fix critical vulnerabilities: Host header validation bypass in path-based security checks, TLS certificate validation bypass via IDNA encoding mismatch, and null byte/control character injection in HTTP headers.

✅ 42 CVEs resolved by this upgrade, including 3 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-10923	🚨 CRITICAL	[starlette] Improper Host header validation allows attackers to craft malicious headers with path or query delimiters, causing request.url.path to diverge from the actual requested path and potentially bypassing path-based security checks or authorization middleware.
CVE-2026-48818	HIGH	[starlette] StaticFiles on Windows is vulnerable to SSRF through UNC paths, which can trigger outbound SMB connections and expose NTLMv2 credentials for offline cracking or relay attacks before returning a 404 response. This affects default deployments on Windows systems regardless of the HTTP response.
CVE-2026-54283	HIGH	[starlette] Request parsing fails to enforce configured limits on field count and size for URL-encoded form data, allowing attackers to bypass resource consumption protections and potentially cause denial of service through unbounded form submissions.
CVE-2026-48710	MEDIUM	[starlette] The HTTP Host header was not validated before reconstructing request.url, allowing malformed headers to cause request.url.path to differ from the actual requested path. This could bypass security restrictions in middleware and endpoints that rely on request.url instead of the raw path.
CVE-2026-48817	MEDIUM	[starlette] HTTPEndpoint improperly dispatches requests by lowercasing HTTP methods and using getattr without restricting to standard verbs, allowing attackers to invoke unintended internal methods as handlers and bypass authorization checks. This affects applications using HTTPEndpoint subclasses via Route without explicit methods constraints.
CVE-2026-54282	MEDIUM	[starlette] The HTTP request path is not validated before reconstructing request.url, allowing an attacker to manipulate the path (e.g., @google.com) to shift the authority boundary and control request.url.hostname. This enables host validation bypass for code relying on request.url.hostname instead of the Host header.
AIKIDO-2026-889297	🚨 CRITICAL	[anyio] TLSStream.wrap() uses outdated IDNA 2003 instead of IDNA 2008 for hostname resolution, causing mismatches between intended and validated hostnames. This enables certificate validation bypass or rejection, potentially allowing man-in-the-middle attacks or legitimate connection failures.
CVE-2026-34520	🚨 CRITICAL	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.
CVE-2026-34515	HIGH	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
CVE-2026-34516	HIGH	[aiohttp] A response with an excessive number of multipart headers can consume more memory than intended, leading to a denial of service (DoS) vulnerability through resource exhaustion.
CVE-2026-47265	HIGH	[aiohttp] Cookies set via the cookies parameter are sent after cross-origin redirects, potentially leaking sensitive data to attackers controlling redirects. This vulnerability allows information disclosure through cookie exposure across different origins.
CVE-2026-54273	HIGH	[aiohttp] An attacker can queue unlimited pipelined HTTP requests, causing excessive memory consumption and leading to denial of service. The vulnerability exists due to the absence of limits on queued pipelined requests.
CVE-2026-54274	HIGH	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.
CVE-2026-54277	HIGH	[aiohttp] A vulnerability in the C parser allows attackers to bypass max_line_size checks, enabling oversized HTTP request lines to consume excessive memory and cause denial of service. This affects the default optimized C parser used in pre-built wheels.
CVE-2026-54278	HIGH	[aiohttp] A vulnerability allows attackers to send compressed payloads that decompress into memory in a single chunk during cleanup, potentially causing denial of service through memory exhaustion (zip bomb attack). This could be exploited in specific situations to crash the application or consume excessive resources.
CVE-2026-34513	HIGH	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.
CVE-2026-50269	HIGH	[aiohttp] Attacker-controlled input in multipart payload headers can be exploited to inject additional headers or modify request contents when user-controlled strings are passed to MultipartWriter.append(headers=...) or Payload.headers. This allows header injection and request manipulation attacks.
CVE-2026-54275	HIGH	[aiohttp] A TLS SNI check bypass vulnerability allows attackers to reuse existing connections with mismatched server_hostname parameters, potentially enabling man-in-the-middle attacks when multiple requests to the same domain use different SNI values. This could lead to unauthorized access to sensitive data or connection hijacking.
CVE-2026-54279	HIGH	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.
CVE-2026-54280	HIGH	[aiohttp] A resource leak vulnerability allows attackers to cause temporary resource starvation by disconnecting during payload writes, preventing proper closure of file handles and similar limited resources until garbage collection occurs.
CVE-2026-34993	HIGH	[aiohttp] CookieJar.load() with untrusted input allows arbitrary code execution through unsafe deserialization. This vulnerability impacts applications that load cookie files from untrusted sources.
CVE-2026-69244	HIGH	[aiohttp] Out-of-bounds heap read in C response parser during error message construction for malformed responses, allowing an attacker-controlled server to trigger a denial-of-service in clients.
CVE-2026-22815	MEDIUM	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.
CVE-2026-59881	MEDIUM	[aiohttp] WebSocket client accepts and decompresses frames with RSV1 bit set even without permessage-deflate extension negotiation, allowing a malicious server to cause excessive CPU and memory consumption (DoS).
CVE-2026-69243	MEDIUM	[aiohttp] HTTP parser vulnerability in WebSocket upgrades allows request smuggling attacks, enabling attackers to bypass protocol handling and potentially execute arbitrary requests or access unauthorized data.
CVE-2026-54276	MEDIUM	[aiohttp] DigestAuthMiddleware can send authentication responses after following cross-origin redirects, potentially exposing user credentials to attackers if combined with open redirect vulnerabilities or weak cryptography.
CVE-2026-34525	MEDIUM	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
CVE-2026-34514	MEDIUM	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
CVE-2026-34517	MEDIUM	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.
CVE-2026-34518	MEDIUM	[aiohttp] When following redirects to a different origin, the framework fails to drop the Cookie and Proxy-Authorization headers alongside the Authorization header, potentially leaking sensitive authentication credentials to untrusted domains.
CVE-2026-34519	MEDIUM	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
AIKIDO-2026-133006	LOW	[aiohttp] A cross-origin redirect vulnerability allows duplicate sensitive headers (Authorization, Cookie, Proxy-Authorization) to leak to unintended third-party hosts because the guard only removes the first copy of each header. This enables credential and session material disclosure through incomplete header stripping during cross-origin redirects.
CVE-2026-44307	HIGH	[mako] A directory traversal vulnerability on Windows allows attackers to bypass path normalization checks using backslash traversal sequences, enabling unauthorized file reads outside the configured template directory.
CVE-2026-41205	HIGH	[mako] Path traversal vulnerability in TemplateLookup.get_template() allows attackers to read arbitrary files by using URIs starting with //, potentially exposing sensitive information when untrusted input is passed to the function.
CVE-2026-44432	HIGH	[urllib3] Improper decompression handling allows attackers to trigger excessive resource consumption (CPU and memory) by forcing full decompression of highly compressed HTTP responses during partial reads or drain operations.
CVE-2026-44431	MEDIUM	[urllib3] is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
AIKIDO-2026-10912	HIGH	[yarl] A URL parser vulnerability allows malformed authority and host strings that violate RFC 3986, enabling host confusion attacks where parsed fields resolve to different hosts than serialized strings, potentially bypassing validation or routing logic.
AIKIDO-2026-472816	MEDIUM	[yarl] A URL parser vulnerability allows crafted inputs with Unicode normalization tricks, IPv6 zone identifiers, and format characters to bypass host validation, enabling host confusion and server-side request forgery attacks when applications compare parsed hosts against serialized strings.
CVE-2026-28684	MEDIUM	[python-dotenv] A local attacker can overwrite arbitrary files by exploiting symlink following in set_key() and unset_key() functions during .env file rewriting. This vulnerability allows arbitrary file write/modification through a crafted symlink when a cross-device rename fallback is triggered.
GHSA-4xgf-cpjx-pc3j	MEDIUM	[pydantic-settings] NestedSecretsSettingsSource with secrets_nested_subdir=True follows symbolic links outside the configured secrets directory, enabling local file read and bypassing the secrets_dir_max_size protection when an attacker can place symlinks in the secrets directory.
CVE-2026-45409	LOW	[idna] A denial-of-service vulnerability exists where specially crafted inputs with repeated Unicode characters cause excessive processing time in domain name validation. Enforcing a 253-character length limit before processing mitigates the issue.
AIKIDO-2026-561892	LOW	[greenlet] A use-after-free vulnerability in free-threaded CPython builds occurs when the garbage collector runs during greenlet suspension, causing saved C-stack state inconsistency and interpreter crashes. Additionally, greenlet switches during critical section locks can deadlock the interpreter.

🤖 Remediation details

Patch transitive and direct Python dependencies to remediate security vulnerabilities in starlette, anyio, aiohttp, mako, urllib3, yarl, python-dotenv, pydantic-settings, idna, and greenlet

Short summary

This PR remediates security vulnerabilities across ten Python packages: starlette, anyio, aiohttp, mako, urllib3, yarl, python-dotenv, pydantic-settings, idna, and greenlet. One direct dependency spec in the root pyproject.toml was updated (fastapi, to unblock the starlette upgrade); all other changes are lockfile-only resolutions via uv lock --upgrade-package. The resolved versions are recorded in uv.lock.

starlette

starlette is a transitive dependency pulled in by fastapi. The previously locked fastapi 0.128.0 declared starlette<0.51.0, which prevented upgrading past 0.50.0. The fastapi lower-bound spec in pyproject.toml was raised from >=0.112.0 to >=0.133.0, allowing the resolver to select fastapi 0.141.1, which in turn allows starlette 1.6.0 — satisfying the ≥1.3.1 patched requirement.

anyio

anyio is a transitive dependency of starlette (and httpx). All parent packages already declared ranges that permit anyio 4.14.2, so no manifest edit was required; the lockfile was refreshed via uv lock --upgrade-package anyio to resolve 4.14.2.

aiohttp

aiohttp is a transitive dependency of aiobotocore (pulled in by aioboto3). The parent's declared range already permitted 3.14.3, so the lockfile was refreshed via uv lock --upgrade-package aiohttp to resolve 3.14.3.

mako

mako is a transitive dependency of alembic. The parent's declared range already permitted 1.3.12, so the lockfile was refreshed via uv lock --upgrade-package mako to resolve 1.4.1.

urllib3

urllib3 is a transitive dependency of botocore (via boto3/aiobotocore) and requests (via azure-core). All parent declared ranges already permitted 2.7.0, so the lockfile was refreshed via uv lock --upgrade-package urllib3 to resolve 2.7.0.

yarl

yarl is a transitive dependency of aiohttp. The parent's declared range already permitted 1.24.5, so the lockfile was refreshed via uv lock --upgrade-package yarl to resolve 1.24.5.

python-dotenv

python-dotenv is a transitive dependency of pydantic-settings. The parent's declared range already permitted 1.2.2, so the lockfile was refreshed via uv lock --upgrade-package python-dotenv to resolve 1.2.3.

pydantic-settings

pydantic-settings is a direct dependency declared as >=2.5.2,<3 in pyproject.toml. That range already permits 2.14.2; the lockfile was refreshed via uv lock --upgrade-package pydantic-settings to resolve 2.15.0.

idna

idna is a transitive dependency of anyio, yarl, httpx, and requests. All parent declared ranges already permitted 3.15, so the lockfile was refreshed via uv lock --upgrade-package idna to resolve 3.19.

greenlet

greenlet is a transitive dependency of sqlalchemy (pulled in by alembic and sqlmodel). The parent's declared range already permitted 3.5.4, so the lockfile was refreshed via uv lock --upgrade-package greenlet to resolve 3.5.5.

Version changes

Package	From	To	Why updated
starlette	0.50.0	1.6.0	Direct CVE fix (transitive via fastapi bump)
fastapi	0.128.0	0.141.1	Parent bump required to unblock starlette ≥1.3.1
anyio	4.12.1	4.14.2	Direct CVE fix (transitive via starlette/httpx, lockfile refresh)
aiohttp	3.13.3	3.14.3	Direct CVE fix (transitive via aiobotocore, lockfile refresh)
mako	1.3.10	1.4.1	Direct CVE fix (transitive via alembic, lockfile refresh)
urllib3	2.6.3	2.7.0	Direct CVE fix (transitive via botocore/requests, lockfile refresh)
yarl	1.22.0	1.24.5	Direct CVE fix (transitive via aiohttp, lockfile refresh)
python-dotenv	1.2.1	1.2.3	Direct CVE fix (transitive via pydantic-settings, lockfile refresh)
pydantic-settings	2.12.0	2.15.0	Direct CVE fix (direct dependency, lockfile refresh)
idna	3.11	3.19	Direct CVE fix (transitive via anyio/yarl/httpx/requests, lockfile refresh)
greenlet	3.3.0	3.5.5	Direct CVE fix (transitive via sqlalchemy, lockfile refresh)