PT-2026-147168

CVE-2026-128129

·

Published

2026-11-13

·

Updated

2026-11-13

Description by

CVSS 4.0
8.2
High
MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can stream data behind an upgrade request to a handler that does not immediately accept or reject the upgrade and cause unbounded memory consumption. This issue is fixed in version 3.14.4.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-770: Allocation of Resources Without Limits or Throttling
Related identifiers
CVE-2026-128129
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com