CVE-2026-54280
published 2026-06-22CVE-2026-54280: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.28%
20.3th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | < 3.14.1 | 3.14.1 |
| aiohttp | aiohttp | >= 0 < 3.14.1 | 3.14.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.01.7LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
aio-libs aiohttp up to 3.14.0 denial of service (GHSA-9x8q-7h8h-wcw9 / EUVD-2026-38316)
vuldb·2026-06-22·CVSS 1.7
CVE-2026-54280 [LOW] aio-libs aiohttp up to 3.14.0 denial of service (GHSA-9x8q-7h8h-wcw9 / EUVD-2026-38316)
A vulnerability, which was classified as problematic, was found in aio-libs aiohttp up to 3.14.0. This vulnerability affects unknown code. The manipulation results in denial of service.
This vulnerability was named CVE-2026-54280. The attack may be performed from remote. There is no available exploit.
You should upgrade the affected component.
GHSA
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
ghsa·2026-06-15
CVE-2026-54280 [LOW] CWE-404 aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
### Summary
Payload resources are not closed correctly when a client disconnects in the middle of a write.
### Impact
If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file.
Patch: https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-22
Published