CVE-2026-54274
published 2026-06-22CVE-2026-54274: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.30%
22.6th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.
Affected
110 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | >= 0 < 3.14.1 | 3.14.1 |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| ansible-automation-platform-27 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
aiohttp: aiohttp: Denial of Service via incomplete websocket frame payloads
vendor_redhat·2026-06-22·CVSS 6.6
CVE-2026-54274 [MEDIUM] CWE-770 aiohttp: aiohttp: Denial of Service via incomplete websocket frame payloads
aiohttp: aiohttp: Denial of Service via incomplete websocket frame payloads
A flaw was found in aiohttp, an asynchronous HTTP client/server framework. An attacker can exploit this vulnerability by sending large, incomplete websocket frame payloads. This can bypass normal memory usage limits, potentially leading to a Denial of Service (DoS) where the affected system becomes unavailable.
Statement: This vulnerability is rated Moderate because an unauthenticated remote attacker can trigger denial of service against an affected aiohttp HTTP server with WebSocket endpoints by sending large incomplete WebSocket frame payloads that bypass memory size limits.
Exploitation requires aiohttp deployed as a network-facing HTTP server that exposes WebSocket endpoints to untrusted clients. Many Red Hat
VulDB
aio-libs aiohttp up to 3.14.0 WebSocket Frame allocation of resources (GHSA-xcgm-r5h9-7989 / EUVD-2026-38311)
vuldb·2026-06-22·CVSS 6.6
CVE-2026-54274 [MEDIUM] aio-libs aiohttp up to 3.14.0 WebSocket Frame allocation of resources (GHSA-xcgm-r5h9-7989 / EUVD-2026-38311)
A vulnerability was found in aio-libs aiohttp up to 3.14.0. It has been classified as problematic. The affected element is an unknown function of the component WebSocket Frame Handler. Performing a manipulation results in allocation of resources.
This vulnerability is identified as CVE-2026-54274. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
aiohttp: Incomplete websocket frame payloads bypass memory limits
ghsa·2026-06-15
CVE-2026-54274 [MEDIUM] CWE-770 aiohttp: Incomplete websocket frame payloads bypass memory limits
aiohttp: Incomplete websocket frame payloads bypass memory limits
### Summary
If an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use.
### Impact
If a web application has WebSocket endpoints, it may be possible for an attacker to execute a DoS attack through excessive memory use.
Patch: https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d
No detection rules found.
No public exploits indexed.
2026-06-22
Published