CVE-2026-54280

LOW EPSS 19.9%

Published Jun 22, 20261w ago · Modified Jun 22, 20261w ago

1.7 CVSS 4.0

Low

Published Jun 22, 2026 1w ago

Last Modified Jun 22, 2026 1w ago

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

CVSS Details

Base Score

1.7

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

19.9% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-404

References 2

github.com https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587
github.com https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.