Allocation of Resources Without Limits or Throttling in aiohttp - #VU163061
Published: November 9, 2026
Vulnerability identifier: #VU163061
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause unbounded memory consumption in an aiohttp server during upgrade handling.
The vulnerability exists due to buffering without size limits or flow control while an upgrade request handler has not completed. An unauthenticated remote attacker can stream data after an upgrade request to a handler that does not immediately accept or reject the upgrade, causing received data to accumulate in memory.
Affected software
aiohttp
Remediation
Install security update from vendor's website.
aiohttp - update to 3.14.4