Executive brief
AIOHTTP is a popular software library used by Python developers to build web servers and applications. A flaw in its request processing component allows an attacker to send specially crafted, oversized web requests that consume excessive server memory. This can lead to a denial-of-service (DoS) condition, making the affected website or service unavailable to legitimate users.
Technical details
A resource exhaustion vulnerability exists in AIOHTTP's optimized C parser due to an improper enforcement of the 'max_line_size' limit. Specifically, the parser fails to correctly validate line lengths for fragmented request targets and reason phrases. A remote, unauthenticated attacker can exploit this by sending an HTTP request with excessively long lines, causing the server to allocate large amounts of memory. This vulnerability primarily affects users of the pre-built wheels which utilize the C-based parser by default. The issue is resolved in version 3.14.1 by enforcing size checks on fragmented lines.
Affected products
- aio-libs aiohttp < 3.14.1
Timeline
- 2026-06-08: advisory: GitHub Security Advisory published by maintainers
- 2026-06-22: disclosed: NVD publication date