CVE-2026-54273
published 2026-06-22CVE-2026-54273: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.28%
20.0th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
Affected
110 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | >= 0 < 3.14.1 | 3.14.1 |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| ansible-automation-platform-27 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
aio-libs aiohttp up to 3.14.0 allocation of resources (GHSA-4fvr-rgm6-gqmc / EUVD-2026-38317)
vuldb·2026-06-22·CVSS 6.6
CVE-2026-54273 [MEDIUM] aio-libs aiohttp up to 3.14.0 allocation of resources (GHSA-4fvr-rgm6-gqmc / EUVD-2026-38317)
A vulnerability was found in aio-libs aiohttp up to 3.14.0. It has been declared as problematic. The impacted element is an unknown function. Executing a manipulation can lead to allocation of resources.
This vulnerability is tracked as CVE-2026-54273. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
ghsa·2026-06-15
CVE-2026-54273 [MEDIUM] CWE-770 aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
### Summary
No limit was present on the number of pipelined requests that could be queued.
### Impact
An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.
Patch: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf
Red Hat
aiohttp: AIOHTTP: Denial of Service via excessive pipelined requests
vendor_redhat·2026-06-22·CVSS 6.6
CVE-2026-54273 [MEDIUM] CWE-770 aiohttp: AIOHTTP: Denial of Service via excessive pipelined requests
aiohttp: AIOHTTP: Denial of Service via excessive pipelined requests
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by sending an unlimited number of pipelined requests, causing the system to consume excessive amounts of memory. This could lead to a Denial of Service (DoS), making the affected system unavailable to legitimate users.
Statement: This vulnerability is rated Moderate because an unauthenticated remote attacker can trigger denial of service against an affected aiohttp HTTP/1 server by sending a large number of pipelined requests, causing excessive memory consumption. Exploitation requires aiohttp to be deployed as an HTTP/1 server that accepts pipelined requests from untrusted clien
No detection rules found.
No public exploits indexed.
2026-06-22
Published