---
schema_version: '1.0'
id: security-20260714-bacc5b
url: https://osv.dev/vulnerability/PYSEC-2026-2111
url_hash: bacc5b72e193dc95052578900f8b3b20719054a1886325c6cb01e770b0ea9e6c
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2111
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-54278
- PYSEC-2026-2111
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- aiohttp
- PyPI
lang: en
published_at: '2026-06-22T18:16:46Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:42:55Z'
status: published
content_hash: 5bf38ac59ceeffba0c467d22acf8a07fd43c3cc3f459427de05237238d3840f0
license_note: full
summary: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
  Prior to 3.14.1, during cleanup it is possible for a compressed request body to
  be decompressed into memory in one chunk. An attacker may be able to send a compressed
  payload in specific situations th
summary_source: rss
summary_en: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and
  Python. Prior to 3.14.1, during cleanup it is possible for a compressed request
  body to be decompressed into memory in one chunk. An attacker may be able to send
  a compressed payload in specific situations th
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-54278 — aiohttp
---

# CVE-2026-54278 — aiohttp

## TL;DR
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations th

## Key Points
- cve / CVE-2026-54278 / PYSEC-2026-2111 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H / aiohttp / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** PYSEC-2026-2111 (CVE-2026-54278)

**Affected (your watchlist):**
- `PyPI:aiohttp` 3.13.3 → fixed in 3.14.1 [docker/docker-strands]

**Details:**
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.

**References:**
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74
- https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2111_

## Source
元記事: [CVE-2026-54278 — aiohttp](https://osv.dev/vulnerability/PYSEC-2026-2111) — published 2026-06-22T18:16:46Z