CVE-2026-54274: AIOHTTP: Incomplete websocket frame payloads bypass memory limits
Summary
If an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use.
Impact
If a web application has WebSocket endpoints, it may be possible for an attacker to execute a DoS attack through excessive memory use.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1 - Upgrade
Upgrade
aio-libs/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1Patch 14b6ee851fb16ec199acb950de0c82d476799e7d
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54274?
The severity of CVE-2026-54274 is rated as medium with a CVSS score of 6.6.
What is the impact of CVE-2026-54274?
CVE-2026-54274 allows attackers to potentially execute a DoS attack by sending large incomplete websocket frame payloads.
How do I fix CVE-2026-54274?
To fix CVE-2026-54274, update to the latest version of the aiohttp package that includes the relevant security patch.
What type of attack is possible with CVE-2026-54274?
CVE-2026-54274 can lead to a denial of service (DoS) attack due to excessive memory usage.
Which software is affected by CVE-2026-54274?
CVE-2026-54274 affects applications using the aiohttp library from pip.