CVE-2026-54277: AIOHTTP DoS Vulnerability

CVE-2026-54277 Overview

CVE-2026-54277 is a denial of service vulnerability in AIOHTTP, an asynchronous HTTP client/server framework for Python's asyncio. The flaw allows attackers to bypass the max_line_size check in the optimized C parser, which ships by default in pre-built wheels. By sending fragmented HTTP request lines, an attacker can force the parser to accumulate oversized lines and exhaust server memory. The issue is categorized as [CWE-770] Allocation of Resources Without Limits or Throttling. AIOHTTP version 3.14.1 resolves the vulnerability.

Critical Impact

Unauthenticated remote attackers can trigger excessive memory allocation in AIOHTTP servers using the C parser, leading to denial of service through resource exhaustion.

Affected Products

• AIOHTTP versions prior to 3.14.1
• Deployments using the default optimized C parser (_http_parser.pyx)
• Python applications relying on pre-built AIOHTTP wheels

Discovery Timeline

• 2026-06-22 - CVE-2026-54277 published to NVD
• 2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-54277

Vulnerability Analysis

The vulnerability resides in the AIOHTTP C parser implementation in aiohttp/_http_parser.pyx. The parser enforces a max_line_size limit to prevent oversized HTTP request lines from consuming unbounded memory. However, the length check only validated the size of an individual incoming fragment, not the cumulative size of the buffered line. When an HTTP request line arrives in multiple TCP segments, each fragment passes the per-call check while the internal buffer grows without bound. An attacker can stream a single oversized header or status line in small chunks to bypass the limit entirely.

Root Cause

The defect is an input validation error in the fragmented-request handling path. The original code compared only the new fragment length against _max_line_size, ignoring data already accumulated in _buf. This logic flaw allowed an unbounded line to be assembled byte by byte while every individual call appeared compliant with the configured limit.

Attack Vector

An unauthenticated remote attacker connects to an AIOHTTP server and transmits an HTTP request whose start line or header line is split across many small TCP writes. The cumulative length far exceeds max_line_size, but no single fragment trips the guard. Sustained connections of this type drive process memory upward until the server becomes unresponsive or is killed by the operating system.

                    const char *at, size_t length) except -1:
     cdef HttpParser pyparser = <HttpParser>parser.data
     try:
-        if length > pyparser._max_line_size:
+        if len(pyparser._buf) + length > pyparser._max_line_size:
             status = pyparser._buf + at[:length]
             raise LineTooLong(status[:100] + b"...", pyparser._max_line_size)
         extend(pyparser._buf, at, length)

Source: aiohttp commit 5ab61bb4 — the patch adds the buffered length len(pyparser._buf) to the incoming fragment length before comparing against _max_line_size, closing the fragmentation bypass.

Detection Methods for CVE-2026-54277

Indicators of Compromise

• Sustained growth of resident memory in Python processes hosting AIOHTTP services without a corresponding increase in legitimate request volume.
• HTTP connections that transmit start lines or headers in unusually small TCP segments over extended periods.
• Application logs showing parser errors, connection resets, or out-of-memory terminations of AIOHTTP workers.

Detection Strategies

• Inventory Python environments for aiohttp installations and flag any version below 3.14.1 using pip list or software composition analysis tooling.
• Inspect network telemetry for clients sending HTTP request lines fragmented across many small packets, particularly when total line length exceeds typical client behavior.
• Correlate web server process memory metrics with incoming request patterns to surface anomalous allocation tied to specific source addresses.

Monitoring Recommendations

• Track per-process RSS and Python heap size for AIOHTTP workers and alert on sudden, sustained increases.
• Log and rate-limit clients that hold connections open while transmitting incomplete HTTP request lines.
• Capture and review reverse proxy or WAF logs for oversized headers blocked upstream of AIOHTTP.

How to Mitigate CVE-2026-54277

Immediate Actions Required

• Upgrade AIOHTTP to version 3.14.1 or later across all affected services.
• Restart Python processes after upgrading to ensure the patched parser is loaded.
• Audit dependency manifests, lockfiles, and container images for transitive AIOHTTP references.

Patch Information

The fix is delivered in AIOHTTP 3.14.1. The corrected check in _http_parser.pyx compares the sum of the existing buffer length and the new fragment length against _max_line_size, raising LineTooLong before further accumulation. Details are published in the GitHub Security Advisory GHSA-63hw-fmq6-xxg2 and the upstream commit 5ab61bb4.

Workarounds

• Place a reverse proxy such as nginx or HAProxy in front of AIOHTTP and enforce strict header and request line size limits at that tier.
• Disable the optimized C parser by forcing the pure-Python parser through aiohttp.web.Application configuration, accepting the performance trade-off until patching is possible.
• Apply per-connection memory and request rate limits at the load balancer to constrain abusive clients.

# Upgrade AIOHTTP to the patched release
pip install --upgrade "aiohttp>=3.14.1"

# Verify the installed version
python -c "import aiohttp; print(aiohttp.__version__)"

# Example nginx limit to bound request line and header size upstream
# large_client_header_buffers 4 8k;
# client_header_buffer_size 1k;