PT-2026-49588 · Pypi · Aiohttp

Denyspakizh-Tob · CVE-2026-54274 · Published 2026-06-15 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.1

Description An issue exists in the asynchronous HTTP client/server framework where an attacker can send large incomplete websocket frame payloads. This allows the attacker to bypass standard memory use size limits, potentially leading to a Denial of Service (DoS) attack through excessive memory consumption if the web application utilizes WebSocket endpoints.

Recommendations Update to version 3.14.1.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-54274

ECHO-E352-AA77-0D12

GHSA-XCGM-R5H9-7989

OESA-2026-2838

OESA-2026-2839

OPENSUSE-SU-2026:21372-1

PYSEC-2026-2108

SUSE-SU-2026:22819-1

SUSE-SU-2026:3207-1

SUSE-SU-2026:3208-1

Affected Products

Aiohttp

References · 72

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54274.json · Exploit
• https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-54277 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:22819-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54273 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-54274 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-54274 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-54274 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2108 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54278 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-54274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54280 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-54274 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-54274 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:3208-1 · Vendor Advisory