CVE-2026-128126

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4

Description The Request.post() function does not limit the number of fields in a URL-encoded form body. Inserting numerous repeated keys into MultiDict results in quadratic time complexity on the event loop, allowing a remote attacker to send a form POST request within the client max size limit to a handler that calls Request.post() and block the event loop.

Recommendations Update to version 3.14.4.