DEBIAN-CVE-2026-123817: High severity debian/python-aiohttp vulnerability

Published Nov 9, 2026

Updated

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by maxmsgsize. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.

Affected Software

3 affected components

debian/python-aiohttp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade aiohttp to a version that resolves this vulnerability.
Fixed in 3.14.4

Event History

Nov 9, 2026

CVE Published

via OSV·10:18 PM

Data Sourced

via OSV·10:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Both aiohttp servers receiving WebSocket frames from malicious clients and aiohttp clients receiving WebSocket frames from malicious servers are affected. Exploitation can lead to excessive memory consumption or denial of service.

Does an attacker need authentication or user interaction to trigger the issue?

No. The provided vector indicates network access with low attack complexity, no privileges, and no user interaction required; the attacker must be able to act as the WebSocket peer.

What attacker behavior triggers excessive memory use?

A malicious peer sends an incomplete WebSocket frame split across many very small transport reads. The reader retains a separate bytes object for each read during reassembly, allowing object overhead to exceed the payload limit imposed by max_msg_size.

What version fixes the vulnerability?

The issue is fixed in aiohttp version 3.14.4. Versions prior to 3.14.4 are affected according to the available information.

DEBIAN-CVE-2026-123817: High severity debian/python-aiohttp vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need authentication or user interaction to trigger the issue?

What attacker behavior triggers excessive memory use?

What version fixes the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need authentication or user interaction to trigger the issue?

What attacker behavior triggers excessive memory use?

What version fixes the vulnerability?