CVE-2026-54277: AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines
Summary
It is possible to bypass the maxlinesize check in parts of an HTTP request in the C parser.
Impact
If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the maxlinesize check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1Patch 5ab61bb4cd88f19b712f12c7c9295fe262bf804d
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54277?
The severity of CVE-2026-54277 is rated at 28.
What does CVE-2026-54277 impact?
CVE-2026-54277 impacts the optimized C parser used in the pip/aiohttp software.
How can attackers exploit CVE-2026-54277?
Attackers can exploit CVE-2026-54277 by sending oversized lines through the HTTP parser, causing excessive memory usage.
How do I fix CVE-2026-54277?
To fix CVE-2026-54277, update to the latest version of pip/aiohttp that addresses this vulnerability.
What is the nature of the vulnerability in CVE-2026-54277?
CVE-2026-54277 is a bypass vulnerability related to the max_line_size check in the HTTP parser.