Resource Management Issue in AIOHTTP Framework by aio-libs

CVE-2026-54280

What is CVE-2026-54280?

AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, has a vulnerability that affects its resource management. Specifically, prior to version 3.14.1, the framework does not close payload resources correctly when a client disconnects in the middle of a write operation. This can lead to resource starvation if a payload utilizes an open file or similar limited resource. An attacker may exploit this condition, temporarily exhausting system resources until the garbage collector or comparable mechanism intervenes to close the file.

References