CVE-2026-54273Medium▾ Sunlitaiohttp: HTTP/1 Pipelined Requests Queue Without Limit
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
Last analysed / modified upstream
0.3% → 0.5%
No limit was present on the number of pipelined requests that could be queued.
An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.
Patch: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf
aiohttp < 3.14.1Upgrade to a patched release:
aiohttp 3.14.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111065Medium· 6.9AIOHTTP: Connector pool exhaustion via Max-Age overflow
GHSA-2g87-pp6c-29x5Highaiohttp: Multiple instances of excessive or unbounded memory/CPU use
CVE-2026-111064High· 8.2aiohttp server lacks an initial request/header timeout
CVE-2025-69229Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2025-69228High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-54277Mediumaiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines