CVE-2026-54274: AIOHTTP WebSocket Memory Exhaustion DoS Vulnerability

Technical summary

CVE-2026-54274 is a memory exhaustion vulnerability in AIOHTTP's websocket frame handling. The vulnerability stems from improper enforcement of size limits (CWE-770) when processing incomplete websocket payloads. Attackers can bypass rate-limiting or size restrictions by sending fragmented frames that individually fall within acceptable bounds but collectively exceed intended memory allocation thresholds. The flaw exists in versions prior to 3.14.1 and does not require authentication or user interaction.

Business impact

Availability of web services built with vulnerable AIOHTTP versions is directly at risk. An unauthenticated attacker from the network can trigger memory exhaustion and denial of service without special privileges. Applications using AIOHTTP for websocket communication—such as real-time collaboration tools, chat platforms, and live data feeds—could experience outages, impacting user experience and service reliability. The attack is straightforward to execute, making it a practical concern for exposed applications.

Affected systems

AIOHTTP versions prior to 3.14.1 are affected. The vulnerability applies to any deployment using AIOHTTP as an HTTP client/server framework with websocket functionality enabled. Python-based applications relying on AIOHTTP for websocket handling, including microservices, API gateways, and interactive web backends, should be assessed for exposure.

Exploitability

This vulnerability requires no authentication, no user interaction, and can be triggered over the network. The attack surface is wide for any AIOHTTP instance accepting websocket connections from untrusted sources. No advanced exploitation techniques are needed—simply sending large incomplete frames is sufficient. The CVSS score of 7.5 (HIGH) reflects the ease of exploitation and impact on availability.

Remediation

Upgrade AIOHTTP to version 3.14.1 or later. This patch version includes corrected size limit enforcement for websocket frame processing, preventing the memory exhaustion bypass. Organizations should prioritize this upgrade for any production systems accepting websocket traffic.

Patch guidance

Update the AIOHTTP dependency to 3.14.1 or newer across all environments. For Python projects using pip, run 'pip install --upgrade aiohttp>=3.14.1'. Verify the update in your requirements.txt or pyproject.toml and test websocket functionality before deploying to production. Check your dependency lock files and CI/CD pipelines to ensure the pinned version reflects the patched release.

Detection guidance

Monitor for memory usage spikes correlated with websocket connection activity, especially from unexpected sources. Log and analyze websocket frame sizes and frequency of incomplete frames. Implement resource limits at the application level (e.g., max concurrent websocket connections, per-connection memory budgets) as a defense-in-depth measure. Alert on sustained high memory consumption or repeated connection resets. Network-level monitoring can flag traffic patterns sending unusually fragmented payloads.

Why prioritize this

HIGH severity combined with unauthenticated network exploitability and denial-of-service impact warrants prompt patching. The vulnerability affects availability, a core security pillar. Any publicly exposed AIOHTTP websocket endpoint should be treated as critical priority. Even internal systems should be upgraded soon to reduce insider risk or lateral movement attack surface.

Risk score, explained

CVSS 7.5 reflects a HIGH severity impact on availability (AV:N/AC:L/PR:N/UI:N). The attack vector is network-based, attack complexity is low, no privileges or user interaction required, and the scope is unchanged. Only availability is affected (A:H), not confidentiality or integrity, preventing a critical rating. However, the combination of ease of exploitation and service disruption potential justifies the HIGH designation.

Frequently asked questions