PYSEC-2026-2108

vendorUSosv

view advisory published 2026-06-22Licence: CC-BY-4.0

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-54274US	high7.5	0.54% (45th)	—	2026-06-22
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible…

references

External citations — patches, advisories, analysis.

https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7dFIX
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan