CVE-2026-54280

AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

Published Jun 22, 2026 CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

Analysis

Technical impact

The vulnerability occurs when a client disconnects during a payload write, causing the framework to leave file or other limited resources open. This temporary resource starvation can lead to denial of service if an attacker repeatedly triggers the flaw, exhausting file descriptors or other scarce resources. The weakness is a missing resource cleanup (CWE-404).

Affected Systems

aio-libs aiohttp versions earlier than 3.14.1 are affected.

Risk and Exploitability

The CVSS score of 1.7 indicates low severity, and the exploitability is limited to situations where an attacker can send requests to an aiohttp instance that uses file-based payloads. No EPSS data is available and the vulnerability is not listed in KEV, suggesting a low likelihood of current exploitation. However, because the flaw permits temporary exhaustion of system resources, careful monitoring is advised.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

aio-libs

aiohttp

affected

Version	Status	Constraints
`< 3.14.1`	affected	—

Configuration 1 [-]

cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Aio-libs

Aiohttp

Version	Status	Scheme	Platform
`[0,3.14.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade aiohttp to version 3.14.1 or later.
If upgrade is not immediately possible, configure the server to limit concurrent connections and monitor open file descriptors to detect potential resource leaks.
Manually manage and close payload resources or implement a custom cleanup routine to ensure file handles are released when a client disconnects.

Generated by OpenCVE AI on June 22, 2026 at 18:38 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4876-1	python-aiohttp security update
Github GHSA	GHSA-9x8q-7h8h-wcw9	aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.460% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9

History

Jun 22, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Aio-libs Aio-libs aiohttp
Vendors & Products		Aio-libs Aio-libs aiohttp

Jun 22, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.
Title		AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect
Weaknesses		CWE-404
References		https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587 https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9
Metrics		cvssV4_0 `{'score': 1.7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U'}`