CVE-2026-123817 AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123817?
CVE-2026-123817 is a high-severity vulnerability in aio-libs aiohttp, published on 9 Nov 2026.
Official description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by max_msg_size. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.
Weakness: CWE-770
Which versions are affected by CVE-2026-123817?
1 open source package ship an affected version, including aiohttp.
| Package | Affected | Fixed in |
|---|---|---|
aiohttp PyPI | All versions | 3.14.4 |
How do I fix CVE-2026-123817?
Upgrade aiohttp to 3.14.4 or later.
Is CVE-2026-123817 being exploited?
There is no known exploitation of CVE-2026-123817 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-JF82982, CLEANSTART-2026-NK38254, DEBIAN-CVE-2026-123817, ECHO-e2f8-166f-a041, GHSA-2g87-pp6c-29x5, MINI-547f-39hj-v7jj and 5 more.