Resource exhaustion in aiohttp - #VU162577
Published: November 9, 2026
Vulnerability identifier: #VU162577
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause excessive memory consumption or block the event loop in aiohttp servers.
The vulnerability exists due to unbounded reads before size checks when aiohttp processes base64-encoded multipart parts containing a short declared content length or prolonged whitespace. An unauthenticated remote attacker can submit a crafted request to a handler that reads multipart data and bypass client_max_size limits.
Affected software
aiohttp
Remediation
Install security update from vendor's website.
aiohttp - update to 3.14.4