{"id":"CVE-2026-54277","aliases":["GHSA-63hw-fmq6-xxg2","PYSEC-2026-2110"],"title":"aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines","summary":"aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines","severity":"medium","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.14.1"],"patched":["aiohttp 3.14.1"],"published":"2026-06-15","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:48.460120366Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-63hw-fmq6-xxg2","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2"},{"url":"https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d"},{"url":"https://github.com/aio-libs/aiohttp"},{"url":"https://github.com/advisories/GHSA-63hw-fmq6-xxg2"}],"tags":["osv","pip","ghsa"],"epss":0.00322,"epssPercentile":0.25458,"cwe":["CWE-770"],"ingestedAt":"2026-07-07T15:41:58.690Z","slug":"CVE-2026-54277","body":"## Overview\n\n### Summary\n\nIt is possible to bypass the max_line_size check in parts of an HTTP request in the C parser.\n\n### Impact\n\nIf using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d\n\n## Affected packages\n\n- `aiohttp < 3.14.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.14.1`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}