GHSA-4FVR-RGM6-GQMC中危已审查

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

OSV 1.4.0 · github-reviewed · 修改于 2026-06-16 04:10

发布时间

2026-06-16 04:10

GitHub 审查时间

2026-06-16 04:10

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/06/GHSA-4fvr-rgm6-gqmc/GHSA-4fvr-rgm6-gqmc.json

公告说明

Summary

No limit was present on the number of pipelined requests that could be queued.

Impact

An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.

Patch: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf

受影响的软件包

PyPI

aiohttp

ECOSYSTEM

引入03.14.1

标识信息

别名 / CVE

CVE-2026-54273

CWE

CWE-770

软件生态

PyPI

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

原始 OSV JSON

{
  "id": "GHSA-4fvr-rgm6-gqmc",
  "aliases": [
    "CVE-2026-54273"
  ],
  "details": "### Summary\n\nNo limit was present on the number of pipelined requests that could be queued.\n\n### Impact\n\nAn attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf",
  "summary": "aiohttp: HTTP/1 Pipelined Requests Queue Without Limit",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.1"
            }
          ]
        }
      ],
      "package": {
        "name": "aiohttp",
        "ecosystem": "PyPI"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 3.14.0"
      }
    }
  ],
  "modified": "2026-06-15T20:10:32Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"
    }
  ],
  "published": "2026-06-15T20:10:32Z",
  "references": [
    {
      "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc",
      "type": "WEB"
    },
    {
      "url": "https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf",
      "type": "WEB"
    },
    {
      "url": "https://github.com/aio-libs/aiohttp",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-06-15T20:10:32Z"
  }
}