Memory Consumption Vulnerability in AIOHTTP Framework by Aio-libs

CVE-2026-123817

What is CVE-2026-123817?

AIOHTTP, an asynchronous HTTP client/server framework for Python's asyncio, is susceptible to a memory consumption issue. In versions prior to 3.14.4, the WebSocket reader can retain multiple bytes objects for each transport read when reassembling incomplete frames. A malicious actor can exploit this by splitting a frame into numerous tiny reads, resulting in an overhead that greatly exceeds the allowed payload by max_msg_size. This exposure can lead to significant memory consumption or result in denial of service, affecting both clients receiving frames from a malicious server and servers handling frames from a malicious client. The issue was addressed in version 3.14.4.

References