CVE-2026-123817: aiohttp: Multiple instances of excessive or unbounded memory/CPU use
Summary
While reassembling a WebSocket frame that arrived across many small transport reads, the reader kept one bytes object per read with no bound on the count. The per-object overhead is many times larger than the payload bytes, so a frame delivered a few bytes at a time could use far more memory than maxmsgsize allows.
Impact
An attacker could cause excessive memory use in a WebSocket server, or a malicious server against a client, by sending a frame in a large number of tiny segments.
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by maxmsgsize. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4