# CVE-2026-54277: aio-libs aiohttp denial of service via max_line_size bypass in C parser

Source: https://junglewise.ai/threats/cve-2026-54277-aio-libs-aiohttp-denial-of-service-via-max-line-size-bypass-in-c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-54277 · Severity: medium · CVSS 4 · Published 2026-06-22

AIOHTTP is a popular software library used by Python developers to build web servers and applications. A flaw in its request processing component allows an attacker to send specially crafted, oversized web requests that consume excessive server memory. This can lead to a denial-of-service (DoS) condition, making the affected website or service unavailable to legitimate users.

Technologies: [aiohttp (PyPI)](https://junglewise.ai/threats/technologies/aiohttp). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-54277 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54277 being exploited in the wild.

**How severe is CVE-2026-54277?** Medium severity, with a CVSS score of 4, published 22 June 2026.

**Which products and versions are affected?** aiohttp (PyPI) <= 3.14.0, ECOSYSTEM:introduced=0,fixed=3.14.1.

**Is there a fix for CVE-2026-54277?** Yes. aiohttp (PyPI): upgrade to 3.14.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54277 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54277?** Check whether you run aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- aiohttp (PyPI): upgrade to 3.14.1 or later

  ```sh
  pip install "aiohttp>=3.14.1"
  ```


## Technical details

A resource exhaustion vulnerability exists in AIOHTTP's optimized C parser due to an improper enforcement of the 'max_line_size' limit. Specifically, the parser fails to correctly validate line lengths for fragmented request targets and reason phrases. A remote, unauthenticated attacker can exploit this by sending an HTTP request with excessively long lines, causing the server to allocate large amounts of memory. This vulnerability primarily affects users of the pre-built wheels which utilize the C-based parser by default. The issue is resolved in version 3.14.1 by enforcing size checks on fragmented lines.

## Affected products

- aio-libs aiohttp < 3.14.1

## Identifiers

- CVE-2026-54277
- GHSA-63hw-fmq6-xxg2
- PYSEC-2026-2110

## Timeline

- 2026-06-08: advisory: GitHub Security Advisory published by maintainers
- 2026-06-22: disclosed: NVD publication date

## References

- [https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d](https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d)
- [https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2](https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2)

## Related threats

- [aiohttp HTTP request smuggling in pure Python parser](https://junglewise.ai/threats/cve-2026-111750-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [aiohttp host-only cookie scope bypass in subdomain handling](https://junglewise.ai/threats/cve-2026-111749-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [aiohttp Request scheme manipulation in absolute-form requests](https://junglewise.ai/threats/cve-2026-111748-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [AIOHTTP multipart request file descriptor exhaustion](https://junglewise.ai/threats/cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [aiohttp cookie Max-Age integer overflow causes connection pool exhaustion](https://junglewise.ai/threats/cve-2026-111065-aiohttp-is-an-asynchronous-http-client-server-framework-for)