CVE-2026-54274: aiohttp Incomplete WebSocket Frame Payloads Bypass Memory Limits
Summary
CVE-2026-54274: aiohttp: Incomplete websocket frame payloads bypass memory limits. Affects aiohttp versions < 3.14.1. Fixed in 3.14.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp is a popular asynchronous HTTP client/server framework for Python, designed to handle asynchronous web requests efficiently. It is widely used for building web applications and services that require high performance and scalability. However, it has a vulnerability that allows attackers to exploit WebSocket endpoints, potentially leading to excessive memory usage.
Vulnerability Detail
The vulnerability arises from the handling of incomplete WebSocket frame payloads. If an attacker sends large, incomplete payloads, they can bypass the memory limits typically enforced by the aiohttp framework. This can lead to Denial of Service (DoS) attacks, where the application consumes excessive memory resources, potentially crashing the server or degrading performance significantly. The issue is classified under CWE-770, which pertains to insufficiently enforced memory limits.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.14.1
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.14.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks on the WebSocket payloads to validate their size before processing them. This can help mitigate the risk of excessive memory usage until you can update the package. Example code snippet to check payload size: 'if len(payload) > MAX_PAYLOAD_SIZE: raise ValueError('Payload too large')'.
Conclusion
CVE-2026-54274 is a significant vulnerability in the aiohttp package that can lead to severe memory issues if not addressed. It is crucial for developers using aiohttp to update to the latest version to protect their applications from potential DoS attacks. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for aiohttp →
FAQ
CVE-2026-54274 is a vulnerability in the aiohttp package that allows attackers to bypass memory limits by sending large incomplete WebSocket frame payloads.
If your application uses aiohttp for WebSocket communication, it may be susceptible to DoS attacks due to excessive memory usage caused by this vulnerability.
Implement additional checks on WebSocket payload sizes as a temporary workaround to mitigate the risk of excessive memory consumption.
You can find more details in the official advisory on GitHub or by visiting the CVE database.
Vulert monitors and alerts you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock, making it easy to stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
