CVE-2026-54280CWE-404

CVE-2026-54280

High · published June 22, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-404 · Improper Resource Shutdown or Release
Published
2026-06-22T22:16Z
Affected products (1)
ProductVersionsFixed in
aiohttp/aiohttp≥ 3.12.1, < 3.14.13.14.1
References (2)
https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587 · [email protected]https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9 · [email protected]
EPSS history
Timeline
  • 22 JUN 16:40Z
    AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect
    cvelistv5