Multipart Data Processing Vulnerability in AIOHTTP Framework

CVE-2026-128127

What is CVE-2026-128127?

AIOHTTP, an asynchronous HTTP client/server framework for Python, is susceptible to an issue in the BodyPartReader.read_chunk() method. This problem arises when processing multipart parts that utilize Content-Transfer-Encoding set to base64. The method continues reading data until reaching a chunk length that is a multiple of four, neglecting to enforce a byte limit. This situation permits a remote attacker to exploit the vulnerability by sending a malicious multipart request that circumvents the client_max_size restriction, potentially leading to excessive memory consumption. This security flaw has been addressed in AIOHTTP version 3.14.4.

References