Python aiohttp: Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. (CVE-2026-54277)
Description
Python aiohttp versions prior to 3.14.1 contain a vulnerability in the C HTTP parser that allows bypassing the max_line_size check. This can enable an attacker to send oversized HTTP request lines, potentially causing excessive memory consumption and denial of service. The issue is fixed in version 3.14.1.
CVSS v3.1
Score 7.5high
Affected software
pkg:deb/ubuntu/python-aiohttp?arch=source&distro=esm-apps-legacy/xenialpkg:deb/ubuntu/python-aiohttp?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/python-aiohttp?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/python-aiohttp?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/python-aiohttp?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/python-aiohttp?arch=source&distro=questingpkg:deb/ubuntu/python-aiohttp?arch=source&distro=stonkingpkg:deb/ubuntu/python-aiohttp?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
AIOHTTP is an asynchronous HTTP client/server framework for Python's asyncio. Versions before 3.14.1 using the default optimized C parser have a vulnerability (CVE-2026-54277) where the max_line_size check can be bypassed in parts of an HTTP request. This allows attackers to send oversized lines through the HTTP parser, which may lead to excessive memory usage and denial of service conditions. The vulnerability is addressed in version 3.14.1.
Potential Impact
An attacker can exploit this vulnerability to cause a denial of service by sending HTTP requests with lines exceeding the maximum allowed size, leading to excessive memory consumption in the affected aiohttp server or client using the C parser. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Upgrade aiohttp to version 3.14.1 or later, where this vulnerability is fixed. No other mitigation is indicated or required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-54277
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:25.10","Ubuntu:26.10","Ubuntu:Pro:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f5fd2cdf04f656663fea
Added to database: 10/17/2026, 22:26:05 UTC
Last enriched: 10/18/2026, 00:49:30 UTC
Last updated: 10/18/2026, 00:49:30 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.