CVE-2026-128124: AIOHTTP: Event loop stall in add_domain() wildcard matching
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.adddomain() converts every asterisk wildcard in a domain mask into a greedy regular-expression fragment, so a mask containing two or more wildcards can take polynomial time to reject a long Host header that does not match. A remote attacker can repeatedly send such headers to a server configured with a multi-wildcard domain mask and stall the event loop. This issue is fixed in version 3.14.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.14.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Servers using AIOHTTP versions prior to 3.14.4 are exposed only if they are configured with an Application.add_domain() domain mask containing two or more asterisk wildcards. A remote client must be able to send HTTP requests with attacker-controlled Host headers.
What does an attacker need to do to trigger the impact?
The attacker sends a long Host header that does not match the configured multi-wildcard domain mask. Repeated requests can cause the wildcard-matching regex to consume polynomial time and stall the asyncio event loop; no privileges or user interaction are required.
Is a default AIOHTTP configuration affected?
The issue depends on a specific Application.add_domain() configuration using a mask with two or more asterisks. The provided information does not indicate that such a mask is enabled by default.
What should teams do if they cannot upgrade immediately?
Avoid or remove Application.add_domain() masks containing two or more asterisk wildcards, where operationally possible. This prevents the vulnerable multi-wildcard matching condition described in the advisory.
How can I determine whether a service is vulnerable?
Check whether the service runs an AIOHTTP version earlier than 3.14.4 and whether its Application.add_domain() configuration includes a domain mask with at least two asterisks. Both conditions are needed for the reported event-loop stall scenario.