CVE-2026-54277

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.1

Description An issue exists in the C parser of the asynchronous HTTP client/server framework where the max line size check can be bypassed in parts of an HTTP request. When using the optimized C parser, which is the default in pre-built wheels, an attacker can send oversized lines through the HTTP parser to consume an excessive amount of memory, potentially resulting in a Denial of Service (DoS), a condition where a system becomes unavailable to its intended users.

Recommendations Update to version 3.14.1.