This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-54278 →
DEBIAN-CVE-2026-54278
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed reques...
Original description
The description as published by the source.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:13
python-aiohttp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
python-aiohttp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.1-1"}]}]
References
- advisory security-tracker.debian.org