[CVE-2026-54274] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if …

Descripción técnica

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

Puntuación CVSS

Score: 7.5/10 — Severidad: HIGH — Estado NIST: Analyzed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Productos afectados

Aiohttp — Aiohttp

Debilidades (CWE)

CWE-770

Fuente oficial

Publicado en NIST NVD.