This issue requests an updates policy exception to update the llhttp package from 6.0.10 to 8.1.0 in Fedora 37, which would break the ABI and bump the SONAME version.

The llhttp package is a C library (transpiled from TypeScript) that provides the low-level HTTP support for NodeJS (which currently bundles it, although the maintainers have discussed unbundling it), and for python-aiohttp. Currently, only python-aiohttp depends on the llhttp package in Fedora.

Versions of llhttp prior to 8.1.1 are affected by CVE-2023-30589, an HTTP request smuggling vulnerability rated 7.7 HIGH in CVSS v3 and rated Moderate by Red Hat. The GitHub advisory for llhttp is GHSA-cggh-pq45-6h9x; the advisory for python-aiohttp is GHSA-45c4-8wx5-qw6w. Upstream for python-aiohttp fixed this by updating llhttp (which they bundle, but we unbundle) in release 3.8.5.

I am not comfortable attempting to backport the fix to an older release of llhttp. My preferred solution would be to update llhttp to 8.1.1 and (in the same side tag) update python-aiohttp to 3.8.5. The ABI break in llhttp would only affect python-aiohttp; the python-aiohttp update itself is compatible (by upstream intent, and verified in COPR); and a large list of packages that depend on python-aiohttp would benefit from the fix.

If this exception request is not approved, my fallback plan is to propose rebuilding python-aiohttp in F37 with AIOHTTP_NO_EXTENSIONS=1, which would convert it to a pure-Python package. This is a documented mitigation, but comes with potentially serious performance regressions, again affecting a fairly large list of dependent packages. The llhttp package would become a leaf package and would remain unpatched.

The situation in EPEL9 is similar, and I plan to request an exception there as well.