VYPR
Medium severity6.6GHSA Advisory· Published Jun 15, 2026· Updated Jun 15, 2026

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

CVE-2026-54277

Description

Summary

It is possible to bypass the max_line_size check in parts of an HTTP request in the C parser.

Impact

If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

11

Patches

Vulnerability mechanics

Root cause

"The C HTTP parser checked only the length of each individual fragment rather than the accumulated buffer length, allowing oversized lines to bypass the max_line_size limit."

Attack vector

An attacker sends an HTTP request whose request target (or a response whose reason phrase) is longer than the configured `max_line_size` (default 8190 bytes), but splits the line across multiple TCP segments so that each individual chunk the parser receives is under the limit. Because the C parser checked only the fragment length, the accumulated line could exceed the limit without raising `LineTooLong`, potentially causing excessive memory consumption and a denial-of-service condition. This affects the default C parser used in pre-built wheels.

Affected code

The bug is in the C HTTP parser's `cb_on_url` and `cb_on_status` callback functions in `aiohttp/_http_parser.pyx`. These callbacks checked only the length of each individual fragment (`length > pyparser._max_line_size`) rather than the accumulated buffer length (`len(pyparser._buf) + length > pyparser._max_line_size`), allowing an oversized request target or response reason phrase to bypass the limit when split across multiple reads.

What the fix does

The patch changes the two checks in `cb_on_url` and `cb_on_status` from `length > pyparser._max_line_size` to `len(pyparser._buf) + length > pyparser._max_line_size`. This ensures the total accumulated line length is compared against the limit, not just the current fragment. The fix aligns the C parser's behavior with the pure-Python parser, which already performed the accumulated-length check.

Preconditions

  • configThe server must use the default C HTTP parser (pre-built wheels).
  • networkThe attacker must be able to send an HTTP request whose request target or response reason phrase is split across multiple TCP segments.
  • inputThe total length of the request target or reason phrase must exceed the max_line_size limit (default 8190 bytes).

Generated on Jun 15, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

1