CVE-2026-54274

MEDIUM EPSS 22.1%

Published Jun 22, 20261w ago · Modified Jun 22, 20261w ago

6.6 CVSS 4.0

Medium

Published Jun 22, 2026 1w ago

Last Modified Jun 22, 2026 1w ago

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

CVSS Details

Base Score

6.6

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

22.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-770

References 2

github.com https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d
github.com https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.