---
schema_version: '1.0'
id: security-20260714-b8656e
url: https://osv.dev/vulnerability/PYSEC-2026-2110
url_hash: b8656ef7b3ab19237739f3e05cbba5a7801e905cfc571ba3075b0163fe96e856
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2110
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-54277
- PYSEC-2026-2110
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- aiohttp
- PyPI
lang: en
published_at: '2026-06-22T18:16:46Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:42:55Z'
status: published
content_hash: a9ec682c630254bcaa82084e1990944269c2266ea128c15cafc8b1cef830ef32
license_note: full
summary: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
  Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an
  HTTP request in the C parser. If using the optimised C parser (the default in pre-built
  wheels), then an attacker may b
summary_source: rss
summary_en: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts
  of an HTTP request in the C parser. If using the optimised C parser (the default
  in pre-built wheels), then an attacker may b
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-54277 — aiohttp
---

# CVE-2026-54277 — aiohttp

## TL;DR
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may b

## Key Points
- cve / CVE-2026-54277 / PYSEC-2026-2110 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H / aiohttp / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** PYSEC-2026-2110 (CVE-2026-54277)

**Affected (your watchlist):**
- `PyPI:aiohttp` 3.13.3 → fixed in 3.14.1 [docker/docker-strands]

**Details:**
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

**References:**
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2
- https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2110_

## Source
元記事: [CVE-2026-54277 — aiohttp](https://osv.dev/vulnerability/PYSEC-2026-2110) — published 2026-06-22T18:16:46Z