Memory Usage Vulnerability in AIOHTTP Framework by aio-libs

CVE-2026-128132

What is CVE-2026-128132?

AIOHTTP, an asynchronous framework designed for HTTP clients and servers in Python, has a vulnerability that originates from the handling of WebSocket messages prior to version 3.14.4. An attacker can exploit this flaw by sending numerous small or compressed messages faster than the application processes them, leading to excessive memory consumption on the client or server side. This issue is particularly significant when using permessage-deflate, as a single read can introduce a substantial amount of decompressed data into the receive queue without properly accounting for empty messages. A fix was implemented in version 3.14.4, and users are urged to update to mitigate potential risks.

References