6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54274

CVE-2026-54274: aiohttp: Incomplete websocket frame payloads bypass memory limits

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54274

CVE-2026-54274:

6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
aiohttp	pip	<= 3.14.0	3.14.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a memory exhaustion flaw in aiohttp's websocket handling. The root cause was that the library checked for oversized messages too late in the data processing pipeline. The function aiohttp._websocket.reader_py.WebSocketReader._feed_data reads raw data from the network. Before the patch, it would parse a websocket frame's header, determine the payload length, and immediately start buffering the payload into memory. The check against the maximum allowed message size (max_msg_size) was only performed in the _handle_frame function, which is called after a complete frame has been received and buffered.

An attacker could exploit this by sending a websocket frame header declaring a very large payload. The _feed_data function would begin allocating memory to buffer this large payload. This allows an attacker to cause the server to consume an excessive amount of memory by sending just a small header, leading to a Denial of Service (DoS), without ever needing to send the full, large payload.

The patch rectifies this by moving the size check into the _feed_data function. A new check calculates the projected_size (current partial message size + the size of the incoming frame) and compares it against the _max_msg_size limit before any of the new frame's payload is read or buffered. If the projected size is too large, it immediately raises an exception, preventing the memory allocation. The vulnerable function is therefore _feed_data, as it's the function that improperly buffers data, and its modification is what fixes the vulnerability.

Vulnerable functions

WebSocketReader._feed_data

aiohttp/_websocket/reader_py.py

This function is responsible for reading and parsing incoming websocket frames. The vulnerability lies in the fact that prior to the patch, this function would read the payload length from a frame header and begin buffering the payload without first checking if the declared size exceeded the configured maximum message size. An attacker could send a frame header with a very large payload length, causing the server to allocate excessive memory as it buffers the incoming (and potentially incomplete) payload, leading to a denial-of-service. The patch introduces a check at the header parsing stage, before the payload is buffered, to validate the projected message size.

WebSocketReader._handle_frame

aiohttp/_websocket/reader_py.py

This function was responsible for processing a fully received websocket frame. It contained a size check, but this check was executed only after the entire frame payload was already buffered into memory by the `_feed_data` function. This made the check ineffective for preventing the excessive memory allocation caused by receiving a frame with a maliciously large declared payload size. The patch removes these late checks and moves the validation logic to an earlier stage in `_feed_data`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.