Skip to main content

aiohttp CVE-2026-54274

| EUVDEUVD-2026-38311 MEDIUM
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-06-15 https://github.com/aio-libs/aiohttp GHSA-xcgm-r5h9-7989
Denial Of Service Red Hat Suse
6.6
CVSS 4.0 · Vendor: https://github.com/aio-libs/aiohttp
Share

Severity by source

Vendor (https://github.com/aio-libs/aiohttp) PRIMARY
6.6 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable WebSocket endpoint, no privileges required at protocol level, no user interaction; pure availability impact with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (https://github.com/aio-libs/aiohttp).

CVSS VectorVendor: https://github.com/aio-libs/aiohttp

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Jun 22, 2026 - 18:23 NVD
6.6 (MEDIUM)
Source Code Evidence Fetched
Jun 15, 2026 - 20:37 vuln.today
Analysis Generated
Jun 15, 2026 - 20:37 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 42,718 pypi packages depend on aiohttp (14,813 direct, 28,685 indirect)

Ecosystem-wide dependent count for version 3.14.1.

DescriptionCVE.org

Summary

If an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use.

Impact

If a web application has WebSocket endpoints, it may be possible for an attacker to execute a DoS attack through excessive memory use.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d

AnalysisAI

Denial-of-service in aiohttp (all versions up to and including 3.14.0) allows remote attackers to exhaust server memory by sending large, incomplete WebSocket frame payloads that bypass the library's configured memory size limits. Any Python web application exposing WebSocket endpoints via aiohttp is affected - no authentication is implied as a prerequisite at the protocol layer. No public exploit code has been identified at time of analysis, but the attack primitive is straightforward and the fix is available in 3.14.1.

Technical ContextAI

aiohttp is a widely-used Python asynchronous HTTP client/server framework built on asyncio. The vulnerability manifests in the WebSocket frame reassembly logic: when a client sends fragmented or incomplete WebSocket frames, aiohttp is expected to buffer incoming frame data until the frame is complete. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause - the frame accumulation path fails to enforce the configured memory ceiling when frames are incomplete, allowing an adversary to drive unbounded heap growth by continuously streaming oversized partial frames. The affected package is distributed via PyPI as pip/aiohttp, and the vulnerable range covers all releases at or below 3.14.0.

RemediationAI

Upgrade aiohttp to version 3.14.1 or later via pip: pip install 'aiohttp>=3.14.1'. The upstream fix is available in commit 14b6ee851fb16ec199acb950de0c82d476799e7d at https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d. If an immediate upgrade is not feasible, a compensating control is to place a reverse proxy (e.g., nginx, HAProxy) in front of the aiohttp application configured to enforce WebSocket frame size limits and connection-level rate limiting - note this adds operational complexity and may not fully replicate the library-level fix. Alternatively, disabling WebSocket endpoints entirely eliminates the attack surface at the cost of losing WebSocket functionality. Restricting WebSocket endpoint access to authenticated or trusted clients via application-level middleware reduces exposure but does not patch the underlying memory accounting flaw.

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8
CVE-2023-38507 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Public Cloud 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-54274 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy