CVE-2026-123817High· 8.7▾ Twilightaiohttp: Multiple instances of excessive or unbounded memory/CPU use
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
While reassembling a WebSocket frame that arrived across many small transport reads, the reader kept one bytes object per read with no bound on the count. The per-object overhead is many times larger than the payload bytes, so a frame delivered a few bytes at a time could use far more memory than max_msg_size allows.
An attacker could cause excessive memory use in a WebSocket server, or a malicious server against a client, by sending a frame in a large number of tiny segments.
aiohttp < 3.14.4Upgrade to a patched release:
aiohttp 3.14.4Connected by shared product, vendor, weakness, or advisory.
GHSA-2g87-pp6c-29x5Highaiohttp: Multiple instances of excessive or unbounded memory/CPU use
CVE-2026-111065Medium· 6.9AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111064High· 8.2aiohttp server lacks an initial request/header timeout
CVE-2026-111748Medium· 6.3AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-111749Low· 2.3AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
CVE-2026-111750Medium· 6.3AIOHTTP: Pure-Python parser request smuggling