Medium [CVE-2026-54277] Denial of Service via oversized HTTP request lines bypassing max_line_size check
This medium-severity Red Hat Linux advisory covers CVE-2026-54277 affecting Red Hat AI Inference Server, Red Hat Discovery 2, Red Hat Enterprise Linux AI (RHEL AI) 3.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser.
If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
A remote attacker can exploit this vulnerability by sending oversized lines within an HTTP request. This bypasses the max_line_size check in the C parser, causing the system to use an excessive amount of memory.
This can lead to a Denial of Service (DoS) condition, making the affected system unavailable. Exploitation requires aiohttp to be deployed as a network-facing HTTP server using the optimised C parser (the default in pre-built wheels).
Many Red Hat products ship aiohttp as a bundled dependency for client libraries, internal automation, or services that do not expose this server/parser path to untrusted users. In those configurations, practical risk may be lower, but affected packages should still be updated to aiohttp 3.14.1 or later when fixes are released.
Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-131.
- < 3.14.1
Official advisory · high-confidence parse· fetched 15 days ago·verify at source
Mitigation checklist
- Update the aiohttp package to version 3.14.1 or later. Until updated builds are available, reduce exposure by not exposing aiohttp-based HTTP servers directly to untrusted networks. As a workaround, configure aiohttp to use the pure-Python HTTP parser by setting use_cparser=False when creating the application or running the server. This avoids the vulnerable C parser path. Installations that use aiohttp only as an HTTP client are not affected by this flaw.
Official advisory · high-confidence parse· fetched 15 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.