PT-2026-141136
CVE-2026-123817
·
Published
2026-10-19
·
Updated
2026-11-10
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
AIOHTTP versions prior to 3.14.4
Description
The WebSocket reader retains one
bytes object for each transport read during the reassembly of an incomplete frame. A malicious peer can split a frame into numerous small reads, causing the per-object overhead to significantly exceed the payload bytes permitted by max msg size. This can lead to excessive memory consumption or a denial of service for both servers receiving frames from a malicious client and clients receiving frames from a malicious server.Recommendations
Update to version 3.14.4.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾