High severity · published Jun 22, 2026
CVE-2026-54280
AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
aiohttp · aio-libs
< 3.14.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54280
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54280
Patch
https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587
Third Party Advisory
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9
More from aiohttp
9.1
CVE-2026-34520
AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass
8.2
CVE-2026-111066
AIOHTTP: File descriptor exhaustion in multipart requests
8.2
CVE-2026-111064
aiohttp server lacks an initial request/header timeout
7.5
CVE-2026-54273
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
7.5
CVE-2026-54278
AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup