CVE-2026-54273: AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
Summary
No limit was present on the number of pipelined requests that could be queued.
Impact
An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1Patch dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54273?
CVE-2026-54273 has a risk level of 28, indicating a significant impact if exploited.
How do I fix CVE-2026-54273?
To mitigate CVE-2026-54273, you should apply the latest patches released by the aiohttp project.
What type of attack does CVE-2026-54273 enable?
CVE-2026-54273 allows for an attacker to use pipelined requests to consume excessive amounts of memory, potentially leading to a Denial of Service (DoS).
What software is affected by CVE-2026-54273?
CVE-2026-54273 affects the aiohttp library within the Python package manager pip.
When was CVE-2026-54273 published?
CVE-2026-54273 was published on June 15, 2026.