{"id":"CVE-2026-123817","aliases":["DEBIAN-CVE-2026-123817","EUVD-2026-120454","GHSA-2g87-pp6c-29x5"],"status":"published","title":"AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by max_msg_size. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00328,"percentile":0.26224,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-10-19T17:07:23Z","modified":"2026-11-10T14:00:06Z","fixes":[{"ecosystem":"PyPI","package":"aiohttp","fixed_in":["3.14.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.14.3"},{"fixed":"3.14.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.0-1","3.10.1-1","3.10.10-1","3.10.10-2","3.10.11-1","3.10.3-1","3.10.3-2","3.10.3-3","3.10.4-1","3.10.5-1","3.10.6-1","3.10.8-1","3.11.15-1","3.11.16-1","3.12.15-1","3.13.0-1","3.13.1-1","3.13.3-1","3.13.3-2","3.13.3-3","3.13.5-1","3.14.0-1","3.14.1-1","3.14.1-2","3.14.1-3","3.14.1-4","3.14.1-5","3.14.3-1","3.8.4-1","3.8.4-1+deb12u1","3.8.4-1+deb12u2","3.8.5-1","3.8.6-1","3.9.1-1","3.9.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.16-1","3.11.16-1+deb13u1","3.12.15-1","3.13.0-1","3.13.1-1","3.13.3-1","3.13.3-2","3.13.3-3","3.13.5-1","3.14.0-1","3.14.1-1","3.14.1-2","3.14.1-3","3.14.1-4","3.14.1-5","3.14.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.16-1","3.12.15-1","3.13.0-1","3.13.1-1","3.13.3-1","3.13.3-2","3.13.3-3","3.13.5-1","3.14.0-1","3.14.1-1","3.14.1-2","3.14.1-3","3.14.1-4","3.14.1-5","3.14.3-1"]},{"source":"osv","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.2","0.20.0","0.20.1","0.20.2","0.21.0","0.21.1","0.21.2","0.21.4","0.21.5","0.21.6","0.22.0","0.22.0a0","0.22.0b0","0.22.0b1","0.22.0b2","0.22.0b3","0.22.0b4","0.22.0b5","0.22.0b6","0.22.1","0.22.2","0.22.3","0.22.4","0.22.5","0.3","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","2.0.0","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.0a1","2.3.0a2","2.3.0a3","2.3.0a4","2.3.1","2.3.10","2.3.1a1","2.3.2","2.3.2b2","2.3.2b3","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0b0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.0b1","3.10.0rc0","3.10.1","3.10.10","3.10.11","3.10.11rc0","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.6rc0","3.10.6rc1","3.10.6rc2","3.10.7","3.10.8","3.10.9","3.11.0","3.11.0b0","3.11.0b1","3.11.0b2","3.11.0b3","3.11.0b4","3.11.0b5","3.11.0rc0","3.11.0rc1","3.11.0rc2","3.11.1","3.11.10","3.11.11","3.11.12","3.11.13","3.11.14","3.11.15","3.11.16","3.11.17","3.11.18","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.11.8","3.11.9","3.12.0","3.12.0b0","3.12.0b1","3.12.0b2","3.12.0b3","3.12.0rc0","3.12.0rc1","3.12.1","3.12.10","3.12.11","3.12.12","3.12.13","3.12.14","3.12.15","3.12.1rc0","3.12.2","3.12.3","3.12.4","3.12.6","3.12.7","3.12.7rc0","3.12.8","3.12.9","3.13.0","3.13.1","3.13.2","3.13.3","3.13.4","3.13.5","3.14.0","3.14.1","3.14.2","3.14.3","3.2.0","3.2.1","3.3.0","3.3.0a0","3.3.1","3.3.2","3.3.2a0","3.4.0","3.4.0a0","3.4.0a3","3.4.0b1","3.4.0b2","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0a1","3.5.0b1","3.5.0b2","3.5.0b3","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0a0","3.6.0a1","3.6.0a11","3.6.0a12","3.6.0a2","3.6.0a3","3.6.0a4","3.6.0a5","3.6.0a6","3.6.0a7","3.6.0a8","3.6.0a9","3.6.0b0","3.6.1","3.6.1b3","3.6.1b4","3.6.2","3.6.2a0","3.6.2a1","3.6.2a2","3.6.3","3.7.0","3.7.0b0","3.7.0b1","3.7.1","3.7.2","3.7.3","3.7.4","3.7.4.post0","3.8.0","3.8.0a7","3.8.0b0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.9.0","3.9.0b0","3.9.0b1","3.9.0rc0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.4rc0","3.9.5"]}],"products":[{"vendor":"aio-libs","product":"aiohttp"}],"references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2g87-pp6c-29x5","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13352","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13612","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/aio-libs/aiohttp/commit/09bcaa73ff084a0c539bbf16a0a78743acb7141f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/aio-libs/aiohttp/commit/6a4f6682817839313b04b8e5cea2b39c1a88ab4f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43","tags":["web"]},{"url":"https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2g87-pp6c-29x5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123817.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123817","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123817","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-123817","title":"AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by max_msg_size. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.","status":"published","published":"2026-11-09T21:17:58.409Z","modified":"2026-11-09T21:17:58.409Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-09T22:35:08.962494Z"}],"euvd":[{"id":"EUVD-2026-120454","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by max_msg_size. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.","status":"published","published":"2026-11-09T21:17:58Z","modified":"2026-11-09T21:17:58Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-09T22:18:21.405141Z"}],"ghsa":[{"id":"GHSA-2g87-pp6c-29x5","title":"aiohttp: Multiple instances of excessive or unbounded memory/CPU use","description":"### Summary\n\nWhile reassembling a WebSocket frame that arrived across many small transport reads, the reader kept one `bytes` object per read with no bound on the count. The per-object overhead is many times larger than the payload bytes, so a frame delivered a few bytes at a time could use far more memory than `max_msg_size` allows.\n\n### Impact\n\nAn attacker could cause excessive memory use in a WebSocket server, or a malicious server against a client, by sending a frame in a large number of tiny segments.","status":"published","published":"2026-10-19T17:07:23Z","modified":"2026-11-09T21:18:34Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-09T21:19:53.571625Z"}],"nvd":[{"id":"CVE-2026-123817","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by max_msg_size. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.","status":"published","published":"2026-11-09T22:18:38.273Z","modified":"2026-11-09T22:18:38.273Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-09T23:16:05.865626Z"}],"osv":[{"id":"CVE-2026-123817","title":"AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by max_msg_size. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.","status":"published","published":"2026-11-09T21:17:58.409Z","modified":"2026-11-11T02:48:44.896247193Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-11T03:22:00.901153Z"},{"id":"DEBIAN-CVE-2026-123817","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by max_msg_size. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.","status":"published","published":"2026-11-09T22:18:38.273Z","modified":"2026-11-10T14:00:06.614947122Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-10T14:31:49.124773Z"},{"id":"GHSA-2g87-pp6c-29x5","title":"aiohttp: Multiple instances of excessive or unbounded memory/CPU use","description":"### Summary\n\nMultiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests.\n\n### Impact\n\nAn attacker could cause resource exhaustion through specially crafted requests.","status":"published","published":"2026-10-19T17:07:23Z","modified":"2026-10-19T17:15:04.113194208Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:34.338541Z"}]}}