CLEANSTART-2026-MP66571: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

Q: What level of access does an attacker need?

The vulnerability is rated as exploitable over the network with low attack complexity. It requires no privileges and no user interaction.

Q: What is the expected security impact?

The reported impact is limited to availability: it can cause a high availability impact. No confidentiality or integrity impact is reported.

Q: Which deployment should be prioritized for triage?

Network-accessible deployments of the cleanstart/apache-superset package should be prioritized, because the reported attack vector is network-based and requires no authentication.

Published Nov 3, 2026

Updated

Security vulnerability affects the apache-superset package. AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

Affected Software

4 affected componentsFixes available

cleanstart/apache-superset<2021.36.5-r0

2021.36.5-r0

cleanstart/apache-superset<2021.38.2-r0

2021.38.2-r0

cleanstart/apache-superset<2021.40.1-r0

2021.40.1-r0

cleanstart/apache-superset<2021.41.0-r0

2021.41.0-r0

Event History

Nov 3, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-54279

Frequently Asked Questions

What level of access does an attacker need?

The vulnerability is rated as exploitable over the network with low attack complexity. It requires no privileges and no user interaction.

What is the expected security impact?

The reported impact is limited to availability: it can cause a high availability impact. No confidentiality or integrity impact is reported.

Which deployment should be prioritized for triage?

Network-accessible deployments of the cleanstart/apache-superset package should be prioritized, because the reported attack vector is network-based and requires no authentication.

CLEANSTART-2026-MP66571: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access does an attacker need?

What is the expected security impact?

Which deployment should be prioritized for triage?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What is the expected security impact?

Which deployment should be prioritized for triage?