CVE-2026-34517: AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS
Summary
For some multipart form fields, aiohttp read the entire field into memory before checking clientmaxsize.
Impact
If an application uses Request.post() an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking clientmaxsize. This issue has been patched in version 3.13.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.13.4