UBUNTU-CVE-2026-123817: Medium severity ubuntu/python-aiohttp vulnerability
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by maxmsgsize. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Both AIOHTTP WebSocket servers that accept connections from malicious clients and AIOHTTP WebSocket clients that connect to malicious servers are affected. The issue applies when an incomplete WebSocket frame can be delivered across many very small transport reads.
What must an attacker do to trigger excessive memory use?
The attacker must act as the WebSocket peer and split an incomplete frame into many tiny transport reads. AIOHTTP retains a separate bytes object for each read while reassembling the frame, allowing object overhead to exceed the payload limit imposed by max_msg_size.
Does max_msg_size prevent this denial of service?
No. Although max_msg_size limits payload bytes, the accumulated per-object overhead from many tiny reads can substantially exceed the allowed payload size.
What version contains the fix?
The issue is fixed in AIOHTTP version 3.14.4. Systems using earlier versions are affected according to the available information.