CVE-2026-128129: AIOHTTP: Unbounded buffering of data received during an upgrade request

Q: Which deployments are realistically exposed to this issue?

Deployments using aiohttp versions earlier than 3.14.4 are exposed when they handle requests marked for protocol upgrade, such as WebSocket handshakes, and the handler does not promptly accept or reject the upgrade.

Q: What does an attacker need to do to trigger the memory exhaustion?

A remote attacker can send an upgrade request and continuously stream additional data behind it while the server is handling the upgrade. No privileges or user interaction are required.

Q: Are all aiohttp applications affected by default?

The issue affects aiohttp versions before 3.14.4, but exploitation depends on an upgrade request reaching a handler that delays its upgrade decision. Applications that do not handle upgrade requests are not described as exploitable by the provided information.

Q: What should be done if patching cannot happen immediately?

Ensure upgrade-request handlers immediately accept or reject upgrade attempts, rather than leaving them pending while receiving additional connection data. Upgrade aiohttp to version 3.14.4 when possible.

Published Nov 13, 2026

Updated

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can stream data behind an upgrade request to a handler that does not immediately accept or reject the upgrade and cause unbounded memory consumption. This issue is fixed in version 3.14.4.

Affected Software

1 affected component

pypi/aiohttp<3.14.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade aiohttp to a version that resolves this vulnerability.
Fixed in 3.14.4

Event History

Nov 13, 2026

CVE Published

via MITRE·08:33 PM

Data Sourced

via MITRE·08:33 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

Deployments using aiohttp versions earlier than 3.14.4 are exposed when they handle requests marked for protocol upgrade, such as WebSocket handshakes, and the handler does not promptly accept or reject the upgrade.

What does an attacker need to do to trigger the memory exhaustion?

A remote attacker can send an upgrade request and continuously stream additional data behind it while the server is handling the upgrade. No privileges or user interaction are required.

Are all aiohttp applications affected by default?

The issue affects aiohttp versions before 3.14.4, but exploitation depends on an upgrade request reaching a handler that delays its upgrade decision. Applications that do not handle upgrade requests are not described as exploitable by the provided information.

What should be done if patching cannot happen immediately?

Ensure upgrade-request handlers immediately accept or reject upgrade attempts, rather than leaving them pending while receiving additional connection data. Upgrade aiohttp to version 3.14.4 when possible.

CVE-2026-128129: AIOHTTP: Unbounded buffering of data received during an upgrade request

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

Are all aiohttp applications affected by default?

What should be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

Are all aiohttp applications affected by default?

What should be done if patching cannot happen immediately?