Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 4, published 19 October 2026.

Which products and versions are affected?

Aio-Libs Aiohttp <= 3.14.3, 0.1 through 3.14.3; aiohttp (PyPI) <= 3.14.3, ECOSYSTEM:introduced=0,fixed=3.14.4.

Is there a fix for This vulnerability?

Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

aiohttp resource exhaustion via unbounded memory/CPU use

Q: Which products and versions are affected?

Aio-Libs Aiohttp <= 3.14.3, 0.1 through 3.14.3; aiohttp (PyPI) <= 3.14.3, ECOSYSTEM:introduced=0,fixed=3.14.4.

Q: Is there a fix for This vulnerability?

Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 4 · Published 2026-10-19

aiohttp is an HTTP client/server library for Python web applications. An attacker can cause denial of service by sending specially crafted requests that trigger excessive memory allocation or CPU consumption, exhausting server resources and making the application unavailable.

Technologies: Aio-Libs Aiohttp, aiohttp (PyPI). Vendors: Aio-Libs, PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 4, published 19 October 2026.
Which products and versions are affected?: Aio-Libs Aiohttp <= 3.14.3, 0.1 through 3.14.3; aiohttp (PyPI) <= 3.14.3, ECOSYSTEM:introduced=0,fixed=3.14.4.
Is there a fix for This vulnerability?: Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

aiohttp (PyPI): upgrade to 3.14.4 or later
```
pip install "aiohttp>=3.14.4"
```

Technical details

Multiple instances of unbounded resource allocation were found in aiohttp, including uncontrolled queueing of WebSocket fragments and other parsing operations. These issues allow remote attackers without authentication to trigger resource exhaustion through maliciously crafted requests, leading to memory depletion or CPU saturation. The vulnerability is addressed across multiple commits implementing resource limits and throttling.

Affected products

aio-libs aiohttp 0.1 through 3.14.3

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.