Fluid Attacks Database

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	python-aiohttp	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.10-1 \|\| =3.10.10-2 \|\| =3.10.11-1 \|\| =3.10.3-1 \|\| =3.10.3-2 \|\| =3.10.3-3 \|\| =3.10.4-1 \|\| =3.10.5-1 \|\| =3.10.6-1 \|\| =3.10.8-1 \|\| =3.11.15-1 \|\| =3.11.16-1 \|\| =3.12.15-1 \|\| =3.13.0-1 \|\| =3.13.1-1 \|\| =3.13.3-1 \|\| =3.13.3-2 \|\| =3.13.3-3 \|\| =3.13.5-1 \|\| =3.14.0-1 \|\| =3.14.1-1 \|\| =3.14.1-2 \|\| =3.14.1-3 \|\| =3.14.1-4 \|\| =3.14.1-5 \|\| =3.14.3-1 \|\| =3.8.4-1 \|\| =3.8.4-1+deb12u1 \|\| =3.8.5-1 \|\| =3.8.6-1 \|\| =3.9.1-1 \|\| =3.9.5-1	-
pypi	aiohttp	>=0 <3.14.1	3.14.1
debian 13	python-aiohttp	=3.11.16-1 \|\| =3.11.16-1+deb13u1 \|\| =3.12.15-1 \|\| =3.13.0-1 \|\| =3.13.1-1 \|\| =3.13.3-1 \|\| =3.13.3-2 \|\| =3.13.3-3 \|\| =3.13.5-1 \|\| =3.14.0-1 \|\| =3.14.1-1 \|\| =3.14.1-2 \|\| =3.14.1-3 \|\| =3.14.1-4 \|\| =3.14.1-5 \|\| =3.14.3-1	-
debian 14	python-aiohttp	=3.11.16-1 \|\| =3.12.15-1 \|\| =3.13.0-1 \|\| =3.13.1-1 \|\| =3.13.3-1 \|\| =3.13.3-2 \|\| =3.13.3-3 \|\| =3.13.5-1 \|\| =3.14.0-1 \|\| >=0 <3.14.1-1	3.14.1-1

Aliases

1. CVE-2026-542802. NVD-2026-542803. OSV-DEBIAN-2026-542804. OSV-2026-542805. GHSA-9x8q-7h8h-wcw96. GCVE-2026-542807. SECURITY-TRACKER-CVE-2026-54280

References

1. https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw92. https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.