Allocation of Resources Without Limits or Throttling in aiohttp - #VU163062
Published: November 9, 2026
Vulnerability identifier: #VU163062
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause unbounded memory use by bypassing aiohttp's WebSocket message size limit.
The vulnerability exists due to an integer overflow in the C extension's WebSocket reader when adding a large declared frame length to the buffered partial message size. An unauthenticated remote attacker can send a small non-final fragment followed by an oversized WebSocket message to bypass the max_msg_size check and continue consuming memory.
Affected software
aiohttp
Remediation
Install security update from vendor's website.
aiohttp - update to 3.14.4