Resource exhaustion in aiohttp - #VU163063
Published: November 9, 2026
Vulnerability identifier: #VU163063
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause excessive memory use in aiohttp WebSocket servers or clients.
The vulnerability exists due to aiohttp's WebSocket reader continuing to parse received frames after the receive queue pauses the transport. An unauthenticated remote attacker can send small messages, or compressed messages with permessage-deflate enabled, faster than the application consumes them to grow a server's queue or a connected client's queue beyond its intended limits.
Affected software
aiohttp
Remediation
Install security update from vendor's website.
aiohttp - update to 3.14.4