Vulnerability - CVE-2026-54274

›

›vulnerability›CVE-2026-54274

Name

CVE-2026-54274

Source

NVD ( link)Debian ( link)

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

CWEs

Published Date

Jun 22, 2026

Updated Date

Jun 26, 2026

Workaround

-

Advisories

https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7dPatch

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989Third Party Advisory

Analysis#

Affected Component

Analysis

Vulnerability Ratings#

6.6

CVSSv4

7.5

CVSSv31

NaN

other

Others affected component#

Name

Project

Project Version

Version

Status

buildroot

master

3.13.5

Exploitable