CVE-2026-54273: AIOHTTP Request Pipelining Denial-of-Service Vulnerability

Technical summary

CVE-2026-54273 is a resource exhaustion vulnerability in AIOHTTP prior to version 3.14.1, stemming from an absent upper bound on pipelined HTTP request queueing. HTTP pipelining allows multiple requests to be sent over a single connection without waiting for responses. Without queue limits, an attacker can flood a connection with requests, each consuming memory buffers until the heap is exhausted. The vulnerability maps to CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v3.1 score of 7.5 (HIGH), indicating significant availability impact with no authentication or user interaction required.

Business impact

Applications built on AIOHTTP versions before 3.14.1 face availability risk. An attacker can remotely trigger denial-of-service conditions, making web services unresponsive or offline. This is particularly severe for production environments where availability is critical. The attack requires no credentials or user interaction, making it a low-barrier threat. Organizations may experience service interruptions, degraded user experience, and operational overhead responding to outages.

Affected systems

AIOHTTP versions prior to 3.14.1 are affected. This includes Python-based web services and applications using AIOHTTP as their HTTP client or server framework. Any application exposing an AIOHTTP server to untrusted networks is vulnerable. Check your requirements.txt, setup.py, or dependency management tools to identify which versions are in use across your infrastructure.

Exploitability

This vulnerability is exploitable with low complexity over the network. An attacker can craft and send pipelined HTTP requests from any internet-connected client without authentication. Many HTTP clients and frameworks support pipelining, making attacks straightforward to execute. No special tools or zero-day knowledge is required. The barrier to exploitation is low, and the impact is immediate and obvious to operators.

Remediation

Upgrade AIOHTTP to version 3.14.1 or later, which implements limits on pipelined request queuing. Review your applications and containers to ensure they use the patched version. Test upgrades in staging environments first, as dependency updates can occasionally introduce compatibility concerns. For organizations unable to patch immediately, consider network-level mitigations such as rate limiting, connection throttling, or WAF rules that restrict rapid pipelined requests.

Patch guidance

Update AIOHTTP to 3.14.1 or a later version. Use your package manager (pip, poetry, conda, etc.) to pull the latest release. For containerized deployments, rebuild images with the updated dependency and redeploy. Verify the patched version is running in production by checking the package metadata or running `pip show aiohttp`. If your application pins dependencies, update the version constraint and rerun dependency resolution to ensure no conflicts arise.

Detection guidance

Monitor AIOHTTP server logs and application memory usage metrics for unusual patterns: rapid increases in memory consumption, high numbers of queued or pending requests, or repeated connection spikes. Network sensors can flag excessive pipelined requests on a single connection. Implement alerting on memory pressure and process crashes. Review HTTP access logs for patterns of many requests arriving in short windows from a single source IP. Runtime application performance monitoring (APM) tools can help identify when pipelined request handling consumes abnormal resources.

Why prioritize this

Although not yet listed in CISA's KEV catalog, this vulnerability warrants prompt attention due to its high CVSS score, network exploitability, and broad impact on availability. The ease of exploitation and the lack of authentication barriers make it a realistic threat in internet-facing deployments. Organizations with public-facing AIOHTTP services should prioritize patching within days, not weeks.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects a high-impact availability attack (AV:N, AC:L, PR:N, UI:N, S:U, A:H). Network accessibility and low attack complexity mean any internet user can trigger the issue without prerequisites. The severity is tempered slightly by the absence of confidentiality or integrity impact—the attacker causes denial of service only, not data breach. The overall risk remains significant for production systems.

Frequently asked questions