Skip to content

GHSA-4fvr-rgm6-gqmc on CTRL-OS 26.05

Aliases: GHSA-4fvr-rgm6-gqmc, CVE-2026-54273

Packages: python3Packages.aiohttp

Status: Plausible

Advisory Information

Summary

No limit was present on the number of pipelined requests that could be queued.

Impact

An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.

Patch: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf

Updates

2026-07-10 22:13 CEST

Metadata changes:

  • Status for package python3Packages.aiohttp: “Plausible”

(Amended on: 2026-07-10 22:14 CEST)

2026-07-10 20:35 CEST

Metadata changes:

  • Status for package python3Packages.aiohttp: “New”