CVE-2026-54277
NoneCVSS
—
EPSS
0.6%
Published
Jun 22, 2026
CISA due date
—
The record
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-aiohttp | 0 | 3.14.1-1.1 |
Related vulnerabilities
- CVE-2026-54279 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-54275 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-54273 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-50269 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34993 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34520 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34514 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp
- CVE-2026-34516 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects python-aiohttp