En bref
- CVE-2026-54278 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant aiohttp, aiohttp (aiohttp).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.49%, plus élevée que 42.4% des vulnérabilités.
- Correctif : mettre à jour vers 3.14.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| aiohttp PyPI | < 3.14.1
| 3.14.1
|
| aiohttp | < 3.14.1
| 3.14.1
|
Description
Summary
During cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.
Impact
An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case).
Workaround
Disable compression if unable to upgrade.
Patch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232
NVD description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free