CVE-2026-128127

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4

Description An issue exists in the read chunk() function when processing a multipart part with the Content-Transfer-Encoding set to base64. The system continues reading until the chunk length is a multiple of four without enforcing a byte limit. This behavior allows a remote attacker to bypass client max size by sending a multipart request with a short Content-Length or a long sequence of whitespace, potentially causing the remaining body to be read into memory or causing the event loop to spin.

Recommendations Update to version 3.14.4.