What’s Vulnerable › Vulnerabilities

CVE-2026-54277: AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-22 · updated 2026-10-25
• Weakness: CWE-770

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

Affected products

• aio-libs aiohttp: before 3.14.1 — fixed in 3.14.1
• Pypi Aiohttp: before 3.14.1; 0.1, 0.10.0, 0.10.1, 0.10.2, 0.11.0, 0.12.0 (+301) — fixed in 3.14.1

How to fix

Upgrade to a fixed version: aio-libs aiohttp 3.14.1; Pypi Aiohttp 3.14.1. Check the vendor advisory for mitigations.

References

• https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2

Get alerted when CVE-2026-54277 or the next vulnerability affects your stack