CVE-2026-54280: AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect
Summary
Payload resources are not closed correctly when a client disconnects in the middle of a write.
Impact
If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1Patch a762eda5242f6490d6ba667533193f8b473ad587
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54280?
CVE-2026-54280 has a risk score of 20, indicating a critical vulnerability.
What are the potential impacts of CVE-2026-54280?
CVE-2026-54280 can cause resource starvation if payloads using open files are not properly managed during client disconnects.
How do I fix CVE-2026-54280?
To fix CVE-2026-54280, ensure that resources are properly closed upon client disconnects in your implementation.
Which software is affected by CVE-2026-54280?
CVE-2026-54280 affects the pip/aiohttp software.
When was CVE-2026-54280 published?
CVE-2026-54280 was published on June 15, 2026.