https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T23:49:34.311497+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-54278 CVE-2026-54278 — AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup 2026-09-29T23:49:34.348460+00:00

Affected: aio-libs aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.

 https://vulnerability.circl.lu/vuln/ghsa-g3cq-j2xw-wf74 GHSA-g3cq-j2xw-wf74 — aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup 2026-09-29T23:49:34.348554+00:00

Affected: PyPI: aiohttp

### Summary

During cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.

### Impact

An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case).

### Workaround

Disable compression if unable to upgrade.

-----

Patch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232

 https://vulnerability.circl.lu/vuln/pysec-2026-2111 PYSEC-2026-2111 2026-09-29T23:49:34.348601+00:00

Affected: PyPI: aiohttp

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.