---
schema_version: '1.0'
id: security-20260714-46393e
url: https://osv.dev/vulnerability/PYSEC-2026-2113
url_hash: 46393e5ced6a57dbcf054cda766f801684373c3052413f045f7eb753af0a2607
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2113
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-54280
- PYSEC-2026-2113
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- aiohttp
- PyPI
lang: en
published_at: '2026-06-22T18:16:46Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:43:41Z'
status: published
content_hash: fb74febd285235bbc6099799de113de1f24f9960ec4e630cf1439eb13ea80d32
license_note: full
summary: 'AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. Prior to 3.14.1, payload resources are not closed correctly when a client
  disconnects in the middle of a write. If a payload is using an open file or similar
  limited resource, then an attacker may be '
summary_source: rss
summary_en: 'AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. Prior to 3.14.1, payload resources are not closed correctly when a client
  disconnects in the middle of a write. If a payload is using an open file or similar
  limited resource, then an attacker may be '
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-54280 — aiohttp
---

# CVE-2026-54280 — aiohttp

## TL;DR
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be 

## Key Points
- cve / CVE-2026-54280 / PYSEC-2026-2113 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H / aiohttp / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** PYSEC-2026-2113 (CVE-2026-54280)

**Affected (your watchlist):**
- `PyPI:aiohttp` 3.13.3 → fixed in 3.14.1 [docker/docker-strands]

**Details:**
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

**References:**
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9
- https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2113_

## Source
元記事: [CVE-2026-54280 — aiohttp](https://osv.dev/vulnerability/PYSEC-2026-2113) — published 2026-06-22T18:16:46Z