Vulnerability in AIOHTTP Framework Affects Python Applications

CVE-2026-128124

What is CVE-2026-128124?

AIOHTTP, a popular asynchronous HTTP client/server framework for Python, has a vulnerability that affects the processing of wildcard domains in HTTP requests. Specifically, prior to version 3.14.4, the Application.add_domain() method improperly handled multiple asterisk wildcards, which could lead to significant delays in processing requests. Attackers could exploit this by sending crafted headers that, when matched against a multi-wildcard domain mask, cause the event loop to become unresponsive, effectively stalling the server. This issue has been resolved in version 3.14.4 of the AIOHTTP framework, which better manages wildcard domains to prevent such DoS attacks.

References