GHSA-2g87-pp6c-29x5: Pip/aiohttp vulnerability
Published Oct 19, 2026
·Updated
Summary
Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests.
Impact
An attacker could cause resource exhaustion through specially crafted requests.
Affected Software
1 affected componentFixes available
pip/aiohttp<=3.14.3
3.14.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4
Event History
Oct 19, 2026
Advisory Published
via GitHub·05:07 PM
Data Sourced
via GitHub·05:07 PM
DescriptionWeaknessAffected Software