# aiohttp resource exhaustion via unbounded memory/CPU use

Source: https://junglewise.ai/threats/aiohttp-multiple-instances-of-excessive-or-unbounded-memory-cpu-use-a4cd3374  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

Severity: high · CVSS 4 · Published 2026-10-19

aiohttp is an HTTP client/server library for Python web applications. An attacker can cause denial of service by sending specially crafted requests that trigger excessive memory allocation or CPU consumption, exhausting server resources and making the application unavailable.

Technologies: [Aio-Libs Aiohttp](https://junglewise.ai/threats/technologies/aio-libs-aiohttp), [aiohttp (PyPI)](https://junglewise.ai/threats/technologies/aiohttp). Vendors: [Aio-Libs](https://junglewise.ai/threats/vendors/aio-libs), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 4, published 19 October 2026.

**Which products and versions are affected?** Aio-Libs Aiohttp <= 3.14.3, 0.1 through 3.14.3; aiohttp (PyPI) <= 3.14.3, ECOSYSTEM:introduced=0,fixed=3.14.4.

**Is there a fix for This vulnerability?** Yes. aiohttp (PyPI): upgrade to 3.14.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Aio-Libs Aiohttp or aiohttp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- aiohttp (PyPI): upgrade to 3.14.4 or later

  ```sh
  pip install "aiohttp>=3.14.4"
  ```


## Technical details

Multiple instances of unbounded resource allocation were found in aiohttp, including uncontrolled queueing of WebSocket fragments and other parsing operations. These issues allow remote attackers without authentication to trigger resource exhaustion through maliciously crafted requests, leading to memory depletion or CPU saturation. The vulnerability is addressed across multiple commits implementing resource limits and throttling.

## Affected products

- aio-libs aiohttp 0.1 through 3.14.3

## Timeline

- 2026-10-19: disclosed

## References

- [https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2g87-pp6c-29x5](https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2g87-pp6c-29x5)
- [https://github.com/aio-libs/aiohttp/commit/09bcaa73ff084a0c539bbf16a0a78743acb7141f](https://github.com/aio-libs/aiohttp/commit/09bcaa73ff084a0c539bbf16a0a78743acb7141f)

## Related threats

- [AIOHTTP WebSocket memory exhaustion via fragmented frames](https://junglewise.ai/threats/cve-2026-123817-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [aiohttp HTTP request smuggling in pure Python parser](https://junglewise.ai/threats/cve-2026-111750-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [aiohttp host-only cookie scope bypass in subdomain handling](https://junglewise.ai/threats/cve-2026-111749-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [aiohttp Request scheme manipulation in absolute-form requests](https://junglewise.ai/threats/cve-2026-111748-aiohttp-is-an-asynchronous-http-client-server-framework-for)
- [AIOHTTP multipart request file descriptor exhaustion](https://junglewise.ai/threats/cve-2026-111066-aiohttp-is-an-asynchronous-http-client-server-framework-for)