Bug 2491463 (CVE-2026-54277)

Summary:	CVE-2026-54277 aiohttp: aiohttp: Denial of Service via oversized HTTP request lines bypassing max_line_size check
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, alinfoot, anpicker, anthomas, aprice, bbrownin, bdettelb, brasmith, cochase, dfreiber, doconnor, dranck, drow, dschmidt, dtrifiro, ehelms, erezende, ggainey, gtanzill, hasun, ilpinto, jburrell, jbuscemi, jdobes, jfula, jkoehler, jlanda, jmitchel, jowilson, jsamir, juwatts, jwong, kaycoth, kshier, lbrazdil, lichen, ljawale, lphiri, ltomasbo, luizcosta, mbarnett, mhulan, mminar, nmoumoul, nweather, nyancey, oezr, omaciel, ometelka, orabin, osousa, pakotvan, pcreech, ptisnovs, rbiba, rbobbitt, rbryant, rchan, rjohnson, simaishi, smallamp, sskracic, stcannon, sthirugn, syedriko, teagle, tmalecek, tpfromme, ttakamiy, vkumar, weaton, xdharmai, xialiu, yguenane, ykashtan, zzhou
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. A remote attacker can exploit this vulnerability by sending oversized lines within an HTTP request. This bypasses the max_line_size check in the C parser, causing the system to use an excessive amount of memory. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-22 18:02:53 UTC

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.