High severity7.5GHSA Advisory· Published Jun 22, 2026· Updated Jun 26, 2026
CVE-2026-54278
CVE-2026-54278
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
aiohttpPyPI | < 3.14.1 | 3.14.1 |
Affected products
36- osv-coords34 versionspkg:apk/chainguard/py3.10-vllm-cuda-12.4pkg:apk/chainguard/tritonserver-backend-vllm-cuda-13.0pkg:apk/chainguard/mlflow-fipspkg:apk/chainguard/py3.10-vllm-cuda-13.0pkg:apk/chainguard/apache-beam-python-3.12-sdkpkg:apk/wolfi/mlflowpkg:apk/chainguard/authentik-2025.12pkg:apk/chainguard/authentik-2026.2pkg:apk/chainguard/dask-kubernetes-fipspkg:apk/chainguard/lmcache-cuda-12.8pkg:apk/chainguard/open-webuipkg:apk/chainguard/py3.13-vllm-cuda-12.9pkg:apk/chainguard/py3.13-vllm-cuda-13.0pkg:apk/chainguard/request-1276pkg:apk/chainguard/apache-beam-python-3.11-sdkpkg:apk/chainguard/authentik-fips-2025.12pkg:apk/chainguard/awxpkg:apk/chainguard/text-generation-inferencepkg:apk/chainguard/py3.12-vllm-cuda-13.0pkg:apk/chainguard/py3.12-vllm-cuda-12.4pkg:apk/chainguard/py3.12-vllm-cuda-12.9pkg:apk/wolfi/open-webuipkg:apk/chainguard/metaflow-service-fipspkg:apk/chainguard/airflow-3pkg:apk/chainguard/authentik-fips-2026.2pkg:apk/chainguard/airflow-core-2pkg:apk/chainguard/apache-beam-python-3.13-sdkpkg:apk/chainguard/tritonserver-backend-vllm-cuda-12.9pkg:pypi/aiohttppkg:apk/chainguard/mlflowpkg:rpm/opensuse/python-aiohttp&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/py3.10-vllm-cuda-12.9pkg:apk/wolfi/airflow-3pkg:apk/chainguard/py3.13-scanner-test-libraries-aiohttp
< 0.18.1-r3+ 33 more
- (no CPE)range: < 0.18.1-r3
- (no CPE)range: < 25.11-r9
- (no CPE)range: < 3.13.0-r1
- (no CPE)range: < 0.20.2-r1
- (no CPE)range: < 2.74.0-r1
- (no CPE)range: < 3.13.0-r1
- (no CPE)range: < 2025.12.6-r3
- (no CPE)range: < 2026.2.4-r4
- (no CPE)range: < 2026.3.0-r4
- (no CPE)range: < 0.5.3-r0
- (no CPE)range: < 0.9.6-r5
- (no CPE)range: < 0.19.1-r0
- (no CPE)range: < 0.20.2-r1
- (no CPE)range: < 0.29.0-r1
- (no CPE)range: < 2.74.0-r3
- (no CPE)range: < 2025.12.6-r2
- (no CPE)range: < 24.6.1-r42
- (no CPE)range: < 3.3.7-r16
- (no CPE)range: < 0.20.2-r1
- (no CPE)range: < 0.18.1-r3
- (no CPE)range: < 0.19.1-r0
- (no CPE)range: < 0.9.6-r5
- (no CPE)range: < 2.5.0-r5
- (no CPE)range: < 3.3.1-r0
- (no CPE)range: < 2026.2.4-r3
- (no CPE)range: < 2.11.2-r6
- (no CPE)range: < 2.74.0-r1
- (no CPE)range: < 25.9.0_git20260617-r2
- (no CPE)range: < 3.14.1
- (no CPE)range: < 3.13.0-r1
- (no CPE)range: < 3.11.16-160000.6.1
- (no CPE)range: < 0.19.1-r0
- (no CPE)range: < 3.3.1-r0
- (no CPE)range: < 0.0.1-r3
Patches
Vulnerability mechanics
References
3- github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232nvdPatch
- github.com/advisories/GHSA-g3cq-j2xw-wf74ghsaADVISORY
- github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74nvdThird Party AdvisoryWEB
News mentions
1- Aiohttp: Nine CVEs Disclosed in a Single Day, Five Memory-Exhaustion DoS FlawsVypr Intelligence · Jun 15, 2026