CVE-2026-54273
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jun 22, 2026
CISA due date
—
The record
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-aiohttp | 0 | 3.14.1-1.1 |
Related vulnerabilities
- CVE-2026-54279 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-54277 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-54275 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-50269 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34993 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34520 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34514 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34516 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp