Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

aiohttp can run out of memory from unlimited pipelined requests

CVE-2026-54273 · published 4 months ago
Summary

Versions of aiohttp released before 3.14.1 do not limit how many HTTP requests can be queued at once. An attacker could send many requests in a row, causing the server to use a lot of memory and possibly stop responding. Update aiohttp to version 3.14.1 or later to restore the limit and protect the service.

What to do
  • Update aiohttp team aiohttp to version 3.14.1.
  • Update debian python-aiohttp to version 3.14.1-1.
  • Update rootio-aiohttp to version 3.13.3+root.io.11.
  • Update rootio-aiohttp to version 3.13.4+root.io.2.
  • Update rootio-aiohttp to version 3.8.6+root.io.7.
  • Update rootio-aiohttp to version 3.8.6+root.io.8.
  • Update rootio-aiohttp to version 3.8.6+root.io.9.
  • Update rootio-aiohttp to version 3.13.5+root.io.3.
  • Update rootio-aiohttp to version 3.13.4+root.io.3.
  • Update aiohttp team aiohttp to version 3.12.14+aikido.7.
  • Update aiohttp team aiohttp to version 3.8.6+aikido.12.
  • Update aiohttp team aiohttp to version 3.9.5+aikido.6.
  • Update aiohttp team aiohttp to version 3.13.4+aikido.6.
  • Update aiohttp team aiohttp to version 3.8.6+aikido.11.
  • Update aiohttp team aiohttp to version 3.13.5+aikido.5.
  • Update aiohttp to version 3.9.5+aikido.7.
  • Update aiohttp to version 3.12.14+aikido.9.
  • Update aiohttp to version 3.14.0+aikido.5.
  • Update aiohttp to version 3.14.0+aikido.6.
  • Update aiohttp aiohttp to version 3.14.1 or later.
Affected software
Ecosystem VendorProductAffected versions
pip aiohttp team aiohttp <= 3.14.0
Fix: upgrade to 3.14.1
Debian:11 debian python-aiohttp All versions
Debian:12 debian python-aiohttp All versions
Debian:13 debian python-aiohttp All versions
Debian:14 debian python-aiohttp < 3.14.1-1
Fix: upgrade to 3.14.1-1
– aiohttp aiohttp < 3.14.1
cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*
Root:PyPI – rootio-aiohttp < 3.13.3+root.io.11
< 3.13.4+root.io.2
< 3.8.6+root.io.7
< 3.8.6+root.io.8
< 3.8.6+root.io.9
< 3.13.5+root.io.3
< 3.13.4+root.io.3
Fix: upgrade to 3.13.3+root.io.11
Ubuntu:Pro:16.04:LTS canonical python-aiohttp All versions
Ubuntu:Pro:18.04:LTS canonical python-aiohttp All versions
Ubuntu:Pro:20.04:LTS canonical python-aiohttp All versions
Ubuntu:Pro:22.04:LTS canonical python-aiohttp All versions
Ubuntu:Pro:24.04:LTS canonical python-aiohttp All versions
Ubuntu:25.10 canonical python-aiohttp All versions
Ubuntu:Pro:26.04:LTS canonical python-aiohttp All versions
Root:PyPI aiohttp team aiohttp < 3.12.14+aikido.7
< 3.8.6+aikido.12
< 3.9.5+aikido.6
< 3.13.4+aikido.6
< 3.8.6+aikido.11
< 3.13.5+aikido.5
Fix: upgrade to 3.12.14+aikido.7
PyPI aiohttp team aiohttp < 3.14.1
Fix: upgrade to 3.14.1
Root:PyPI – aiohttp < 3.9.5+aikido.7
< 3.12.14+aikido.9
< 3.14.0+aikido.5
< 3.14.0+aikido.6
Fix: upgrade to 3.9.5+aikido.7
Original advisory text
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published22 Jun 2026
Updated4 Nov 2026
First seen15 Jun 2026
Sources
DEBIAN-CVE-2026-54273 · OSV
ROOT-APP-PYPI-CVE-2026-54273 · OSV
UBUNTU-CVE-2026-54273 · OSV
GHSA-4fvr-rgm6-gqmc · GHSA
CVE-2026-54273 · NVD
GHSA-4fvr-rgm6-gqmc · OSV
CVE-2026-54273 · OSV
Track software like this
Free during beta