Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123817— AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads

Quick assessment

Affected
aio-libs aiohttp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AIOHTTP 是一个基于 asyncio 和 Python 的异步 HTTP 客户端/服务器框架。在 3.14.4 版本之前，WebSocket 读取器在重组不完整的帧时，会为每次传输读取保留一个字节对象。恶意对等方可以将一个帧拆分为大量极小的读取操作，使得每个对象带来的开销远超 max_msg_size 所允许的有效载荷字节数。该问题影响从恶意客户端接收帧的服务器，以及从恶意服务器接收帧的客户端，可能导致内存过度消耗或服务拒绝（DoS）。此问题已在 3.14.4 版本中修复。

CVSS 8.7 · High

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123817

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads
Source: CVE Program / CVE List V5
Vulnerability Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by max_msg_size. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
aio-libs aiohttp < 3.14.4 -

II. Public POCs for CVE-2026-123817

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123817

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-123817 (3)

Vendor Advisories for CVE-2026-123817 (1)

Vendor Pages for CVE-2026-123817 (1)

IV. Related Vulnerabilities

Same product: aiohttp
Same vendor: aio-libs
Same weakness: CWE-770