CVE-2026-54273

Katalog CVE

CVSS 7.5 · High EPSS 0,49%

Kerentanan Allocation of Resources Without Limits or Throttling pada aiohttp. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

Rincian

Terbit di NVD

22 Juni 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf patch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc advisory pihak ketiga