GHSA-9x8q-7h8h-wcw9 CVE-2026-54280 PYSEC-2026-2113
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.46%
- Chance of exploitation in the next 30 days. Higher than 39.93% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-404 Improper Resource Shutdown or Release
- Fix
3.14.1- Upgrade aiohttp to this version or later
Description
Summary
Payload resources are not closed correctly when a client disconnects in the middle of a write.
Impact
If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file.
Patch: https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| aiohttp | < 3.14.1 |
3.14.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
aiohttp PyPI → 3.14.1
- pip
pip install --upgrade "aiohttp>=3.14.1"- poetry
poetry add "aiohttp>=3.14.1"- uv
uv add "aiohttp>=3.14.1"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Unreported
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-404: Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
How to prevent it
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
- Implementation: It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
- Implementation: Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
- Implementation: When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pqxq-w44r-73xw AIOHTTP: Pure-Python parser request smuggling | Medium | Also affects aiohttp |
| GHSA-gx76-c99x-2c96 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies | Low | Also affects aiohttp |
| GHSA-f9xw-jh8m-3mwq AIOHTTP: Absolute-form request targets can spoof Request.scheme | Medium | Also affects aiohttp |
| GHSA-9xw5-w5jj-pvcg AIOHTTP: File descriptor exhaustion in multipart requests | High | Also affects aiohttp |
| GHSA-6cjc-53gc-5rqm AIOHTTP: Connector pool exhaustion via Max-Age overflow | Medium | Also affects aiohttp |
| GHSA-5wr8-gcqf-gqf3 aiohttp server lacks an initial request/header timeout | High | Also affects aiohttp |
| GHSA-494j-54xm-rwp3 AIOHTTP: Secure attribute not enforced for shared cookie | Medium | Also affects aiohttp |
| GHSA-2g87-pp6c-29x5 aiohttp: Multiple instances of excessive or unbounded memory/CPU use | High | Also affects aiohttp |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor