Inefficient Algorithmic Complexity in aiohttp - #VU163064
Published: November 9, 2026
Vulnerability identifier: #VU163064
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause excessive CPU use and block the event loop of an aiohttp server or client.
The vulnerability exists due to quadratic decompression work in aiohttp when processing many concatenated compressed members, including empty members that evade output limits. An unauthenticated remote attacker can submit crafted request bodies or WebSocket messages, or serve malicious responses to a connecting client, to trigger the blocking.
Affected software
aiohttp
Remediation
Install security update from vendor's website.
aiohttp - update to 3.14.4