{"id":"CVE-2026-54274","aliases":["GHSA-xcgm-r5h9-7989","PYSEC-2026-2108"],"title":"aiohttp: Incomplete websocket frame payloads bypass memory limits","summary":"aiohttp: Incomplete websocket frame payloads bypass memory limits","severity":"medium","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.14.1"],"patched":["aiohttp 3.14.1"],"published":"2026-06-15","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:12.346397944Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-xcgm-r5h9-7989","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989"},{"url":"https://github.com/aio-libs/aiohttp"},{"url":"https://github.com/advisories/GHSA-xcgm-r5h9-7989"}],"tags":["osv","pip","ghsa"],"epss":0.00305,"epssPercentile":0.23438,"cwe":["CWE-770"],"ingestedAt":"2026-07-07T15:41:58.679Z","slug":"CVE-2026-54274","body":"## Overview\n\n### Summary\n\nIf an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use.\n\n### Impact\n\nIf a web application has WebSocket endpoints, it may be possible for an attacker to execute a DoS attack through excessive memory use.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d\n\n## Affected packages\n\n- `aiohttp < 3.14.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.14.1`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}