CVE-2026-54278

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.1

Description During cleanup, a compressed request body can be decompressed into memory in a single chunk. An attacker may send a compressed payload in specific situations that could be decompressed into memory, potentially leading to a Denial of Service (DoS) via a zip bomb, which is a malicious archive designed to crash or freeze the system by expanding to an enormous size upon decompression.

Recommendations Update to version 3.14.1. Disable compression as a temporary workaround if an upgrade is not possible.