Allocation of Resources Without Limits or Throttling in aiohttp - #VU163060
Published: November 9, 2026
Vulnerability identifier: #VU163060
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause excessive memory consumption and repeated processing of HTTP requests.
The vulnerability exists due to duplicate buffering in aiohttp's pure-Python HTTP parser when a full pipelined request queue is followed by a declined upgrade. An unauthenticated remote attacker can send an upgrade request with pipelined requests to servers configured to use the Python parser, causing buffered requests to be replayed and memory use to grow.
Affected software
aiohttp
Remediation
Install security update from vendor's website.
aiohttp - update to 3.14.4