CVE-2026-128126: AIOHTTP: Too many URL-encoded form fields block the event loop

Published Nov 13, 2026

Updated

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Request.post() does not limit the number of fields in a URL-encoded form body, and inserting many repeated keys into MultiDict takes quadratic time on the event loop. A remote attacker can send a form POST within clientmaxsize to a handler that calls Request.post() and block the event loop. This issue is fixed in version 3.14.4.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.14.4

Event History

Nov 13, 2026

CVE Published

via MITRE·08:27 PM

Data Sourced

via MITRE·08:27 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using AIOHTTP versions before 3.14.4 are exposed if they have a handler that calls Request.post() on URL-encoded form submissions. The malicious request must remain within the application's configured client_max_size.

What does an attacker need to do to exploit it?

An unauthenticated remote attacker only needs to send a URL-encoded form POST containing many repeated field names to a reachable handler that invokes Request.post(). Processing those fields can take quadratic time and block the asyncio event loop.

Are applications that do not parse form data with Request.post() affected?

The described vulnerable path specifically requires a handler to call Request.post() for a URL-encoded form body. Applications without reachable handlers that use Request.post() are not described as affected by this issue.

What should teams do if they cannot upgrade immediately?

Ensure reachable handlers do not call Request.post() on untrusted URL-encoded form bodies, or otherwise prevent such requests from reaching those handlers. Any temporary measure must account for the request still being allowed within client_max_size.

How can I determine whether the issue has been remediated?

Upgrade AIOHTTP to version 3.14.4. Versions prior to 3.14.4 are described as lacking a limit on the number of URL-encoded form fields processed by Request.post().

CVE-2026-128126: AIOHTTP: Too many URL-encoded form fields block the event loop

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to do to exploit it?

Are applications that do not parse form data with Request.post() affected?

What should teams do if they cannot upgrade immediately?

How can I determine whether the issue has been remediated?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to do to exploit it?

Are applications that do not parse form data with Request.post() affected?

What should teams do if they cannot upgrade immediately?

How can I determine whether the issue has been remediated?