CVE-2026-54274

AIOHTTP: Incomplete websocket frame payloads bypass memory limits

Published Jun 22, 2026 CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

Analysis

Technical impact

The flaw allows an attacker to send large, incomplete WebSocket frames that bypass the framework’s configured memory size checks. The result is that the server can consume more memory than intended, potentially exhausting available resources and degrading or halting service availability. The weakness is a classic resource exhaustion issue (CWE-770).

Affected Systems

The affected product is the aio-libs AIOHTTP framework, versions earlier than 3.14.1. Systems running any of those versions are susceptible, regardless of platform or deployment environment.

Risk and Exploitability

The CVSS score of 6.6 reflects a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating low documented exploitation. Attackers would need remote access via a WebSocket connection to the vulnerable service. If exploited, a single attacker could consume a significant fraction of the host’s memory, leading to service interruption. The lack of an exploited reference suggests the attack path is not widely used yet, but the risk remains due to the potential for denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

aio-libs

aiohttp

affected

Version	Status	Constraints
`< 3.14.1`	affected	—

Configuration 1 [-]

cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Aio-libs

Aiohttp

Version	Status	Scheme	Platform
`[0,3.14.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to AIOHTTP version 3.14.1 or later, which implements proper payload size validation.
If an upgrade is not immediately possible, restrict WebSocket connections to trusted networks only and consider inserting application layer limits on payload sizes.
Replace or upgrade the library to an alternative that enforces strict memory limits for WebSocket frames.

Generated by OpenCVE AI on June 22, 2026 at 18:22 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4876-1	python-aiohttp security update
Github GHSA	GHSA-xcgm-r5h9-7989	aiohttp: Incomplete websocket frame payloads bypass memory limits

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.539% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989
https://nvd.nist.gov/vuln/detail/CVE-2026-54274
https://www.cve.org/CVERecord?id=CVE-2026-54274

History

Jun 26, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-54274 https://www.cve.org/CVERecord?id=CVE-2026-54274
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jun 22, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Aio-libs Aio-libs aiohttp
Vendors & Products		Aio-libs Aio-libs aiohttp

Jun 22, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.
Title		AIOHTTP: Incomplete websocket frame payloads bypass memory limits
Weaknesses		CWE-770
References		https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989
Metrics		cvssV4_0 `{'score': 6.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U'}`