En resumen
- CVE-2026-54278 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a aiohttp, aiohttp (aiohttp).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.49%, mayor que el 42.4% de las vulnerabilidades.
- Solución: actualizar a 3.14.1 o posterior.
| Package | Affected versions | Patched versions |
|---|
| aiohttp PyPI | < 3.14.1
| 3.14.1
|
| aiohttp | < 3.14.1
| 3.14.1
|
Description
Summary
During cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.
Impact
An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case).
Workaround
Disable compression if unable to upgrade.
Patch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232
NVD description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free