aiohttp CVE-2026-54280

aiohttp is an async HTTP client/server framework for Python, distributed via pip (CPE: pkg:pip/aiohttp). The flaw resides in aiohttp/web_response.py within the write_eof() coroutine of the Response class. Before the fix, the method called await self._body.write(self._payload_writer) sequentially followed by await self._body.close(). If write() raised any exception - most commonly ConnectionResetError when a TCP client disconnected mid-transfer - or if the enclosing asyncio Task was cancelled (e.g., request timeout), Python's exception propagation caused execution to bypass close(), leaving any OS resource held by the Payload (e.g., an open file descriptor) unreleased. This is a textbook CWE-404 (Improper Resource Shutdown or Release): the cleanup path was conditional on the happy path rather than guaranteed. The commit diff at a762eda5242f6490d6ba667533193f8b473ad587 shows the fix as a minimal two-line change: wrapping write() in a try block with close() moved to a finally clause, ensuring the Payload lifecycle is always honored regardless of how write() terminates.