CVE-2026-54280

תיאור (מקור, אנגלית)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

מדדים

CVSS 3.1

7.5 (HIGH) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS 4.0

1.7 (LOW) מקור הציון: CNA CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-13/8/2026

CWE

CWE-404

מוצרים מושפעים

aiohttp: aiohttp

קישורים

• https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473‮… Patch
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9 Third Party Advisory