CVE-2026-54277
published 2026-06-22CVE-2026-54277: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.32%
24.4th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
Affected
62 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | >= 0 < 3.14.1 | 3.14.1 |
| debian | python-aiohttp | — | — |
| discovery | discovery-server-rhel9 | — | — |
| rhaiis | vllm-spyre-rhel9 | — | — |
| rhelai3 | bootc-aws-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-rocm-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-gcp-cuda-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhoai | odh-automl-rhel9 | — | — |
| rhoai | odh-autorag-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-kserve-agent-rhel9 | — | — |
| rhoai | odh-kserve-autogluon-server-rhel9 | — | — |
| rhoai | odh-kserve-controller-rhel9 | — | — |
| rhoai | odh-kserve-router-rhel9 | — | — |
| rhoai | odh-kserve-storage-initializer-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-llm-d-kv-cache-rhel9 | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| rhoai | odh-mlserver-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
aiohttp: aiohttp: Denial of Service via oversized HTTP request lines bypassing max_line_size check
vendor_redhat·2026-06-22·CVSS 6.6
CVE-2026-54277 [MEDIUM] CWE-131 aiohttp: aiohttp: Denial of Service via oversized HTTP request lines bypassing max_line_size check
aiohttp: aiohttp: Denial of Service via oversized HTTP request lines bypassing max_line_size check
A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. A remote attacker can exploit this vulnerability by sending oversized lines within an HTTP request. This bypasses the max_line_size check in the C parser, causing the system to use an excessive amount of memory. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable.
Statement: This vulnerability is rated Moderate because an unauthenticated remote attacker can trigger denial of service against an affected aiohttp HTTP server that uses the default C-based parser, by sending HTTP requests with oversized fragmented lines that bypass max_line_size limits, causing excessive
VulDB
aio-libs aiohttp up to 3.14.0 C Parser allocation of resources (GHSA-63hw-fmq6-xxg2)
vuldb·2026-06-22·CVSS 6.6
CVE-2026-54277 [MEDIUM] aio-libs aiohttp up to 3.14.0 C Parser allocation of resources (GHSA-63hw-fmq6-xxg2)
A vulnerability classified as problematic was found in aio-libs aiohttp up to 3.14.0. This issue affects some unknown processing of the component C Parser. The manipulation results in allocation of resources.
This vulnerability is known as CVE-2026-54277. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is advised.
GHSA
aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
ghsa·2026-06-15
CVE-2026-54277 [MEDIUM] CWE-770 aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
### Summary
It is possible to bypass the max_line_size check in parts of an HTTP request in the C parser.
### Impact
If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS.
Patch: https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d
No detection rules found.
No public exploits indexed.
2026-06-22
Published