aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

HIGH 7.5CVE-2026-54273 · GHSA-4fvr-rgm6-gqmc · PYSEC-2026-2107 · Published 22/06/2026 · updated 25/10/2026

Package	Affected versions	Patched versions
aiohttp PyPI	`< 3.14.1`	`3.14.1`
aiohttp aiohttp	`< 3.14.1`	`3.14.1`

Description

Summary

No limit was present on the number of pipelined requests that could be queued.

Impact

An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.

Patch: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf

NVD description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

References

aio-libs/aiohttp security advisory · WEB
aio-libs/aiohttp commit dfdfa9d · WEB
aio-libs/aiohttp · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free