Memory Management Issue in AIOHTTP Framework by Aio-libs

CVE-2026-128130

What is CVE-2026-128130?

AIOHTTP, a popular asynchronous HTTP client/server framework for Python, has a memory management vulnerability prior to version 3.14.4. When the pipelined request queue reaches its limit, the pure-Python parser retains unparsed data internally while also relaying it to the caller. This causes an accumulation of unprocessed requests, which results in increased memory consumption and potential repeat processing of already handled requests. This issue is particularly significant for deployments using AIOHTTP_NO_EXTENSIONS or those operating without the standard C-extension wheel. The vulnerability can negatively impact application performance and resource usage.

References