CVE-2026-54273: aiohttp HTTP/1 Pipelined Requests Queue Without Limit
Summary
CVE-2026-54273: aiohttp: HTTP/1 Pipelined Requests Queue Without Limit. Affects aiohttp versions < 3.14.1. Fixed in 3.14.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp is a popular asynchronous HTTP client/server framework for Python, designed to facilitate the development of web applications and services. It supports both client-side and server-side programming, allowing developers to handle HTTP requests and responses efficiently. However, a recent vulnerability has been identified that allows an unlimited number of pipelined requests to be queued, which can lead to excessive memory usage and potential denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from the lack of a limit on the number of pipelined requests that can be queued in aiohttp. This oversight allows attackers to send numerous pipelined requests, consuming excessive amounts of memory on the server. If exploited, this could lead to a denial of service, where legitimate users are unable to access the service due to resource exhaustion. The vulnerability is classified under CWE-770, indicating an issue with insufficiently enforced limits.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.14.1
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.14.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement request throttling or limit the number of concurrent requests your application will accept. This can help mitigate the impact of the vulnerability until you can update to the patched version.
Conclusion
The vulnerability identified as CVE-2026-54273 in the aiohttp package allows for unlimited pipelined requests, potentially leading to denial of service due to excessive memory usage. It is crucial to update to version 3.14.1 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for aiohttp →
FAQ
The CVSS score of this vulnerability is 6.6, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Pipelined requests allow multiple HTTP requests to be sent on a single TCP connection without waiting for the corresponding responses, which can improve performance but also lead to resource exhaustion if not managed properly.
While the primary risk is denial of service, excessive memory usage could potentially lead to application instability, which may indirectly affect data integrity.
If you cannot update aiohttp right away, consider implementing request throttling or limiting concurrent requests as a temporary measure to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
