CVE-2026-54279: aio-libs aiohttp Improper Initialization
CVSS: 7.5v3.1HighAnalyzed
AliasesGHSA-2fqr-mr3j-6wp8PYSEC-2026-2112UBUNTU-CVE-2026-54279DEBIAN-CVE-2026-54279CGA-32g4-gf6m-64c9CGA-395m-cmxm-68v9CGA-59x4-crpr-4r59CGA-622m-vrxc-fm25CGA-6jwh-9v4p-m44vCGA-9wvm-frfj-ph64CGA-f332-jhfh-53xrCGA-g28w-329c-4xp5CGA-pmpq-3g28-46c3CGA-r4jc-9wjq-v2rfCGA-23p7-hmgw-6c6pCGA-2498-jm2p-rghwCGA-2mr4-hc3w-64fpCGA-2q63-ff9g-7wh8CGA-3cph-m6mp-mjv2CGA-3jpw-x9r3-rcqhCGA-4p86-5rf3-8g7mCGA-54v8-57wp-7vqgCGA-5cgm-j29h-4q5xCGA-5j79-pcgq-398rCGA-67q8-x76c-m9grCGA-6cwg-jrqp-3vmhCGA-77rh-r45j-5m4gCGA-7f9f-7fgf-54vcCGA-95v2-rv53-w2cgCGA-9hmr-ww73-w87vCGA-c55x-44fm-949pCGA-c697-gf75-m4jfCGA-c933-qg4x-37xqCGA-chv8-8xc3-f2ppCGA-cmh9-p5x6-vr33CGA-cwj8-wp4x-f8q4CGA-cwq8-938m-cgr8CGA-f42c-rpj3-mjpfCGA-fwjc-m45w-pjv4CGA-g9f5-8fhv-qp88CGA-gh93-8638-2p3cCGA-hhr6-pjvm-7543CGA-jvhg-jm58-vfqwCGA-mjvv-2w97-76chCGA-mp5m-44mw-qpqjCGA-mq82-825p-q5pvCGA-mwhq-4xqw-2mh6CGA-pxh4-9xhv-36mcCGA-qfjg-3jj6-p9hfCGA-qr5j-hm3c-27v9CGA-r73v-4fcp-4vgqCGA-r8xg-7gvg-6x3cCGA-rgg6-3394-cxjrCGA-v95w-g3vw-28fxCGA-vgqv-53fg-hjmpCGA-vr85-h9fj-7f6vCGA-w9cj-2fgv-j383CGA-wr2x-c69j-qh34CGA-x5m9-rv36-f955CGA-x765-9qv5-5g9wCGA-xrrh-6984-6qjg
Published 22-06-2026Last modified 22-06-2026
Vulnerability summary
CVE-2026-54279 is a high (CVSS 7.5) Improper Initialization vulnerability in aio-libs aiohttp. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.1% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.49%
0%100%
Low · +0.21 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 22-06-2026PublishedVulnerability first disclosed.
- 22-06-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.
CVSS metrics
9 scores · 7 sources · 2 versionsLow 1.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:USources5 sources · 1.3–5.3
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:UDiffers
- NVDNIST1.3LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.21 pp
From 0.28% on 20-09-2026
20-09-202620-10-2026
EPSS score0.49%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard31 products
- airflow-2All versions (No fix recorded)
- airflow-3< 3.2.2-r7 | < 3.3.1-r0
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- airflow-core-2< 2.11.2-r6
- apache-beam-python-3.11-sdk< 2.74.0-r3
Wolfi4 products
- airflow-3< 3.2.2-r7 | < 3.3.1-r0
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- mlflow< 3.16.0-r0 | < 3.13.0-r1
- open-webui< 0.9.6-r5
Aio-libs1 product
- aiohttp< 3.14.1
Aiohttp1 product
- aiohttp< 3.14.1
Debian1 product
- python-aiohttpAll versions (No fix recorded) | < 3.14.1-1
PyPI1 product
- aiohttp< 3.14.1
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded)
7 vendors · 40 products
References
8 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8X Refsource CONFIRMWEBAdvisoryREPORTThird Party Advisory
- github.com/aio-libs/aiohttpPACKAGE
