CVE-2026-54278: aio-libs aiohttp
CVSS: 7.5v3.1HighAnalyzed
AliasesGHSA-g3cq-j2xw-wf74PYSEC-2026-2111UBUNTU-CVE-2026-54278DEBIAN-CVE-2026-54278CGA-2765-v2xr-cf8fCGA-5g88-w33h-694xCGA-72cp-6r92-mf4xCGA-8j7r-pjh9-m8w9CGA-9gf2-cfg2-mfv9CGA-c8wv-cqf3-578qCGA-g7g6-5qvv-qpw9CGA-jx2v-xff8-g4m2CGA-v9pj-cjff-cc92CGA-x749-vffp-c5hmCGA-26rm-w8gx-88vrCGA-28j2-6cw8-fg4hCGA-298m-c3m6-6w7gCGA-2fpq-c2x2-55hqCGA-2w77-8hp7-rw27CGA-36fx-g82f-98mgCGA-3h22-2w6m-6m6hCGA-3mqw-7q9p-5353CGA-3wcf-4m4f-2564CGA-45v2-hx2x-2xmcCGA-4mmv-6w3w-g59qCGA-528x-hfpq-rccwCGA-53rc-4g8c-vj4wCGA-58fp-9jf3-6rc7CGA-622x-r28q-fjf7CGA-65v2-pqcp-xv7wCGA-7c6x-qgrx-7frxCGA-8hxh-pqqr-pj8rCGA-cqw5-j3x6-3wchCGA-fr52-j6xw-22w5CGA-fx6v-ff5r-pp9qCGA-gfmr-75m9-53c7CGA-gjgw-f895-cj6mCGA-h5x2-6rvp-mhqxCGA-hrvq-q45w-325vCGA-hww8-xf4p-v7v7CGA-j5p8-hrjx-9pvgCGA-j5w4-wf5p-2wh3CGA-m38p-qhpf-8636CGA-m3j6-53rp-fjvrCGA-mqjf-7prf-2v8jCGA-mx39-6hp3-9cf9CGA-p8jc-m4xw-73r2CGA-pm6v-vgq4-fxfwCGA-px4x-7p7q-5jmrCGA-q6v7-xj93-pp52CGA-q75v-pmj2-q8j2CGA-qhqp-jm8c-fv72CGA-r6gh-8w68-x646CGA-v54c-gm5g-99j9CGA-v82c-f6wx-x3rcCGA-v82j-h63h-ph6hCGA-vc56-9975-m9mmCGA-x39h-hjr4-5pfrCGA-x5fm-7662-rvgfCGA-xh9p-xhj4-3v9fCGA-xrg6-8x2f-w3mm
Published 22-06-2026Last modified 23-06-2026
Vulnerability summary
CVE-2026-54278 is a high (CVSS 7.5) vulnerability in aio-libs aiohttp. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.1% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.49%
0%100%
Low · +0.10 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 22-06-2026PublishedVulnerability first disclosed.
- 23-06-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.
CVSS metrics
9 scores · 7 sources · 2 versionsMedium 6.6Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:USources5 sources · 6.6–8.7
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST6.6MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.10 pp
From 0.40% on 20-09-2026
20-09-202620-10-2026
EPSS score0.49%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard31 products
- airflow-2All versions (No fix recorded)
- airflow-3< 3.3.1-r0 | < 3.2.2-r7
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- airflow-core-2< 2.11.2-r6
- apache-beam-python-3.11-sdk< 2.74.0-r3
Wolfi4 products
- airflow-3< 3.3.1-r0 | < 3.2.2-r7
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- mlflow< 3.16.0-r0 | < 3.13.0-r1
- open-webui< 0.9.6-r5
Aio-libs1 product
- aiohttp< 3.14.1
Aiohttp1 product
- aiohttp< 3.14.1
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.14.1-1
PyPI1 product
- aiohttp< 3.14.1
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded)
7 vendors · 40 products
References
8 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74X Refsource CONFIRMWEBAdvisoryREPORTThird Party Advisory
- github.com/aio-libs/aiohttpPACKAGE
