CVE-2026-54278: AIOHTTP Zip Bomb DoS Vulnerability (3.14.1 Fix)

Technical summary

The vulnerability exists in AIOHTTP's request cleanup logic when handling Content-Encoded request bodies. Prior to version 3.14.1, the framework does not properly limit decompression of compressed payloads, allowing an attacker to send a highly compressed payload that expands to an unexpectedly large size in memory during the cleanup phase. This violates CWE-409 (Improper Handling of Highly Compressed Data), a classic resource exhaustion weakness. The vector indicates network accessibility with low attack complexity and no privilege or user interaction required, resulting in availability impact only (no confidentiality or integrity loss).

Business impact

Organizations relying on AIOHTTP for HTTP services face denial-of-service risk. An attacker can trigger resource exhaustion on exposed AIOHTTP instances, causing service unavailability. The impact depends on deployment scope—single-instance services may see brief outages, while containerized or serverless deployments with auto-scaling may absorb repeated attacks but at operational cost. Applications processing untrusted HTTP requests from the internet are at highest risk. No data breach or corruption occurs, but service continuity is threatened.

Affected systems

AIOHTTP versions prior to 3.14.1 are affected. The vulnerability applies to both client and server use cases where compressed request bodies are processed. Applications using AIOHTTP as an HTTP server exposed to untrusted clients, or as a client consuming untrusted HTTP responses, may be impacted. Verify your installed version via `pip show aiohttp` or your package manager's inventory tools.

Exploitability

This vulnerability is exploitable without authentication, user interaction, or special network conditions. An attacker can send a single malicious HTTP request from the internet to trigger it. The attack surface includes any exposed AIOHTTP HTTP endpoint. No exploitation tools are publicly available yet (vulnerability was published in June 2026), but the attack pattern is straightforward—compress legitimate-looking data with high compression ratios and send it as a request body. Organizations should treat this as readily exploitable once awareness increases.

Remediation

Upgrade AIOHTTP to version 3.14.1 or later. This is the primary mitigation. For environments where immediate patching is impractical, implement network-level rate limiting and request size restrictions on HTTP endpoints to reduce the blast radius of compression-based DoS attacks. Monitor for abnormal memory spikes during request processing as an interim detection signal.

Patch guidance

Upgrade AIOHTTP using your standard package management workflow. For pip-based projects, run `pip install --upgrade aiohttp>=3.14.1`. Update your requirements.txt, Pipfile, or pyproject.toml to pin version 3.14.1 or later. Test the upgrade in a staging environment first, as dependency changes can occasionally affect application behavior. Verify the upgrade by confirming the version with `pip show aiohttp` and spot-checking that HTTP endpoints remain functional under normal load.

Detection guidance

Monitor AIOHTTP application logs for decompression-related errors or warnings during request processing. Watch for sudden memory consumption spikes during HTTP request handling, especially when the request size appears small but memory usage is disproportionate—a classic indicator of decompression attacks. Set up alerting on request processing latency and memory usage to detect anomalies. Network-level detection is difficult without payload inspection, but unusual patterns of small HTTP requests followed by high CPU/memory on the application server warrant investigation.

Why prioritize this

While the CVSS score of 7.5 (HIGH) reflects network accessibility and guaranteed denial-of-service impact, this vulnerability should be prioritized based on your organization's reliance on AIOHTTP. Public exposure of AIOHTTP endpoints elevates priority; internal-only services lower it. The lack of current public exploits provides a window for orderly patching before active attacks likely emerge. Prioritize based on (1) whether AIOHTTP is internet-facing, (2) SLA sensitivity to service interruption, and (3) deployment complexity of the patch.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network accessibility from any attacker (AV:N), (2) Low attack complexity requiring only a crafted HTTP request (AC:L), (3) No privilege or user interaction required (PR:N, UI:N), (4) Unavailability of affected services as the sole impact (A:H, C:N, I:N). The HIGH severity is appropriate for availability-critical services. Organizations with strict uptime requirements should treat this as a critical priority despite no data confidentiality impact.

Frequently asked questions