PatchTheCVEaiohttp vulnerabilities and fixes
Recent CVEs affecting aiohttp, with upgrade or downgrade steps. 13 tracked.
aiohttp has 13 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 13. Most recent: 2026-06-22. Highest priority: CVE-2026-54274 (score 43/100).
- CVE-2026-34515 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-34516 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-54274 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-54277 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-50269 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-54273 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-54278 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-54279 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-22815 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-34513 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-54275 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-54280 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-54276 MEDIUM 6.1 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
FAQ
How do I fix aiohttp vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is aiohttp being exploited right now?
None of the tracked aiohttp CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which aiohttp CVE should I patch first?
CVE-2026-54274 currently ranks highest (43/100): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.