WebSocket Memory Consumption Vulnerability in AIOHTTP Framework
CVE-2026-128128

7.5HIGH

Key Information:

Vendor

Aio-libs

Status
Aiohttp
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128128?

A vulnerability in the AIOHTTP framework allows a remote peer to exploit the WebSocket reader, leading to unbounded memory consumption. By sending a small non-final fragment followed by an oversized message, attackers can manipulate the declared frame length using signed 64-bit arithmetic, potentially causing resource exhaustion on the server. This issue has been addressed in version 3.14.4 of AIOHTTP.

Affected Version(s)

aiohttp < 3.14.4

References

https://github.com/aio-libs/aiohttp/security/advisories/G...
x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/pull/13415
x_refsource_MISC
https://github.com/aio-libs/aiohttp/pull/13494
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.