Skip to main content

aiohttp EUVDEUVD-2026-38315

| CVE-2026-54278 MEDIUM
Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)
2026-06-15 https://github.com/aio-libs/aiohttp GHSA-g3cq-j2xw-wf74
Information Disclosure Red Hat Suse
6.6
CVSS 4.0 · Vendor: https://github.com/aio-libs/aiohttp
Share

Severity by source

Vendor (https://github.com/aio-libs/aiohttp) PRIMARY
6.6 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

Network vector (AV:N), no auth (PR:N), but AC:H because triggering the cleanup path requires specific connection timing; DoS-only impact (A:H, C:N, I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (https://github.com/aio-libs/aiohttp).

CVSS VectorVendor: https://github.com/aio-libs/aiohttp

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Jun 22, 2026 - 18:23 NVD
6.6 (MEDIUM)
Source Code Evidence Fetched
Jun 15, 2026 - 20:34 vuln.today
Analysis Generated
Jun 15, 2026 - 20:34 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 42,718 pypi packages depend on aiohttp (14,813 direct, 28,685 indirect)

Ecosystem-wide dependent count for version 3.14.1.

DescriptionCVE.org

Summary

During cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.

Impact

An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case).

Workaround

Disable compression if unable to upgrade.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232

AnalysisAI

Unread compressed request bodies in aiohttp bypass the client_max_size limit during the cleanup phase, allowing a single-chunk decompression of an arbitrarily large payload into server memory. All versions up to and including 3.14.0 are affected. An attacker who can send HTTP requests with compressed bodies can trigger a zip bomb condition during cleanup, exhausting server memory and causing denial of service. No public exploit has been identified at time of analysis.

Technical ContextAI

aiohttp is a widely-used asynchronous HTTP client/server framework for Python, distributed as a pip package (pkg:pip/aiohttp). The vulnerability falls under CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification), where the root cause is the failure to enforce the configured client_max_size size limit during the request cleanup path. Normally, client_max_size guards against oversized request bodies, but during the cleanup phase, the decompression occurs in a single unbounded operation, circumventing this safeguard. A zip bomb is a specially crafted compressed file that expands to a disproportionately large size on decompression - a classic CWE-409 exploitation technique. The specific trigger is the cleanup phase of request lifecycle, meaning the vulnerability fires when aiohttp processes the remaining unread compressed body on connection teardown rather than during normal streaming ingestion.

RemediationAI

Upgrade aiohttp to version 3.14.1 or later; this is the vendor-confirmed fix for all affected versions (<= 3.14.0), delivered via commit 4f7480e474cccc6a8cc2c92ad3f17a31dedf8232. If upgrading is not immediately possible, the vendor explicitly recommends disabling compression support as a workaround - concretely, this means disabling acceptance of compressed HTTP request bodies (Content-Encoding: gzip/deflate/br) at the application or reverse-proxy layer. Note that disabling compression may break clients that rely on sending compressed payloads and could increase bandwidth for high-traffic deployments. Full advisory and patch details at https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74.

Same weakness CWE-409 – Improper Handling of Highly Compressed Data (Data Amplification)

View all
CVE-2026-59803 HIGH POC
8.7
CVE-2026-59939 HIGH POC
7.5
CVE-2024-7765 HIGH POC
7.5
CVE-2026-22776 HIGH POC
7.5
CVE-2026-22870 HIGH POC
7.5
CVE-2024-3572 HIGH POC
7.5
CVE-2025-58057 MEDIUM POC
6.9
CVE-2025-46730 MEDIUM POC
6.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Public Cloud 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-38315 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy