High severity · published Jun 22, 2026
CVE-2026-54277
AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
aiohttp · aio-libs
< 3.14.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54277
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54277
Patch
https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d
Vendor Advisory
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2
More from aiohttp
9.1
CVE-2026-34520
AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass
8.2
CVE-2026-111066
AIOHTTP: File descriptor exhaustion in multipart requests
8.2
CVE-2026-111064
aiohttp server lacks an initial request/header timeout
7.5
CVE-2026-54273
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
7.5
CVE-2026-54280
AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect