CVE-2026-54278
published 2026-06-22CVE-2026-54278: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.28%
20.1th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.
Affected
110 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | >= 0 < 3.14.1 | 3.14.1 |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| ansible-automation-platform-27 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
aiohttp: aiohttp: Denial of Service due to excessive memory consumption from compressed request body
vendor_redhat·2026-06-22·CVSS 6.6
CVE-2026-54278 [MEDIUM] CWE-409 aiohttp: aiohttp: Denial of Service due to excessive memory consumption from compressed request body
aiohttp: aiohttp: Denial of Service due to excessive memory consumption from compressed request body
A flaw was found in aiohttp, an asynchronous HTTP client/server framework. An attacker could send a specially crafted compressed request body that, during cleanup, would be decompressed into memory in one large chunk. This could potentially lead to a Denial of Service (DoS) condition, where the affected system becomes unresponsive or unavailable.
Statement: This vulnerability is rated Moderate because an unauthenticated remote attacker can trigger denial of service against an affected aiohttp HTTP server by sending a compressed request body that is decompressed into memory in one large chunk during cleanup, bypassing client_max_size limits (a zip-bomb style edge case). Exploitation requir
VulDB
aio-libs aiohttp up to 3.14.0 Request Body data amplification (GHSA-g3cq-j2xw-wf74)
vuldb·2026-06-22·CVSS 6.6
CVE-2026-54278 [MEDIUM] aio-libs aiohttp up to 3.14.0 Request Body data amplification (GHSA-g3cq-j2xw-wf74)
A vulnerability, which was classified as problematic, has been found in aio-libs aiohttp up to 3.14.0. Impacted is an unknown function of the component Request Body Handler. This manipulation causes highly compressed data.
This vulnerability is handled as CVE-2026-54278. The attack can be initiated remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
GHSA
aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
ghsa·2026-06-15
CVE-2026-54278 [MEDIUM] CWE-409 aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
### Summary
During cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.
### Impact
An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case).
### Workaround
Disable compression if unable to upgrade.
Patch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232
No detection rules found.
No public exploits indexed.
2026-06-22
Published