Skip to main content

aiohttp CVE-2026-54273

| EUVDEUVD-2026-38317 MEDIUM
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-06-15 https://github.com/aio-libs/aiohttp GHSA-4fvr-rgm6-gqmc
Denial Of Service Red Hat Suse
6.6
CVSS 4.0 · Vendor: https://github.com/aio-libs/aiohttp
Share

Severity by source

Vendor (https://github.com/aio-libs/aiohttp) PRIMARY
6.6 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-accessible with no authentication or user interaction required; impact is availability-only (memory exhaustion DoS), with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (https://github.com/aio-libs/aiohttp).

CVSS VectorVendor: https://github.com/aio-libs/aiohttp

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Jun 22, 2026 - 18:23 NVD
6.6 (MEDIUM)
Source Code Evidence Fetched
Jun 15, 2026 - 20:35 vuln.today
Analysis Generated
Jun 15, 2026 - 20:35 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 42,718 pypi packages depend on aiohttp (14,813 direct, 28,685 indirect)

Ecosystem-wide dependent count for version 3.14.1.

DescriptionCVE.org

Summary

No limit was present on the number of pipelined requests that could be queued.

Impact

An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf

AnalysisAI

Unbounded HTTP/1 pipelined request queuing in aiohttp server allows a remote, unauthenticated attacker to exhaust process memory and cause denial of service by sending pipelined requests faster than the server can handle them. All aiohttp server deployments at version 3.14.0 and earlier are affected; the client library is not impacted. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, though the attack requires no special tooling beyond a standard HTTP/1.1 client capable of pipelining.

Technical ContextAI

aiohttp is a widely-used Python async HTTP client/server framework distributed via pip (pkg:pip/aiohttp). The vulnerability resides in the HTTP/1 request pipeline parser, implemented in both Cython (aiohttp/_http_parser.pyx via llhttp) and pure Python (aiohttp/http_parser.py). HTTP/1.1 pipelining permits a client to transmit multiple requests on a single TCP connection without awaiting each response. Prior to 3.14.1, the server buffered an unlimited number of fully-parsed but unhandled requests in memory with no back-pressure mechanism. CWE-770 (Allocation of Resources Without Limits or Throttling) precisely identifies the root cause. The fix, committed at dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf, introduces _max_msg_queue_size and _msg_in_flight counters: when the in-flight queue reaches the configured limit the parser signals HPE_PAUSED through llhttp and calls transport.pause_reading(), buffering remaining data as a tail; parsing resumes via feed_data(b'') once the application handler drains the queue through the new message_consumed() callback. The fix spans both the Cython and pure-Python parser paths and the base_protocol flow-control layer.

RemediationAI

Upgrade aiohttp to version 3.14.1 immediately; this release introduces per-connection pipelined request queue limits with transport-level back-pressure, fully resolving the issue. The upstream commit is available at https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf and the security advisory at https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc. If an immediate upgrade is not feasible, consider the following compensating controls with their trade-offs: (1) Place nginx or another reverse proxy in front of aiohttp configured to disable or cap HTTP/1.1 pipelining - this adds a hop and may reduce throughput for HTTP/1.1 clients but is the most effective workaround; (2) Enforce per-client connection limits and request rate limits at the load balancer or firewall to bound how quickly a single attacker can queue requests - this reduces attack impact but does not eliminate the unbounded queue; (3) If your deployment is solely HTTP/2 or HTTP/3, pipelining does not apply and risk is negligible, though upgrading the aiohttp dependency remains best practice. None of these workarounds replaces the patch.

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8
CVE-2023-38507 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Public Cloud 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected

Share

CVE-2026-54273 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy