CVE-2026-54280
published 2026-06-22CVE-2026-54280: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.46%
39.7th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | >= 0 < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | >= 3.12.1 < 3.14.1 | 3.14.1 |
| mta | mta-solution-server-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.01.7LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
aio-libs aiohttp up to 3.14.0 denial of service (GHSA-9x8q-7h8h-wcw9 / EUVD-2026-38316)
vuldb·2026-06-22·CVSS 1.7
CVE-2026-54280 [LOW] aio-libs aiohttp up to 3.14.0 denial of service (GHSA-9x8q-7h8h-wcw9 / EUVD-2026-38316)
A vulnerability, which was classified as problematic, was found in aio-libs aiohttp up to 3.14.0. This vulnerability affects unknown code. The manipulation results in denial of service.
This vulnerability was named CVE-2026-54280. The attack may be performed from remote. There is no available exploit.
You should upgrade the affected component.
GHSA
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
ghsa·2026-06-15
CVE-2026-54280 [LOW] CWE-404 aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
### Summary
Payload resources are not closed correctly when a client disconnects in the middle of a write.
### Impact
If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file.
Patch: https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587
Red Hat
aiohttp: AIOHTTP: Denial of Service due to improper resource handling
vendor_redhat·2026-06-22·CVSS 7.5
CVE-2026-54280 [HIGH] CWE-772 aiohttp: AIOHTTP: Denial of Service due to improper resource handling
aiohttp: AIOHTTP: Denial of Service due to improper resource handling
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. A remote attacker could exploit this vulnerability by disconnecting during a payload write, leading to improper closure of resources. This can cause temporary resource starvation, resulting in a Denial of Service (DoS) condition.
Pack
No detection rules found.
No public exploits indexed.
2026-06-22
Published