CVE-2026-128129 in aiohttp
Summary
by MITRE • 11/13/2026
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can stream data behind an upgrade request to a handler that does not immediately accept or reject the upgrade and cause unbounded memory consumption. This issue is fixed in version 3.14.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in aiohttp, specifically affecting versions prior to 3.14.4, represents a critical resource exhaustion flaw rooted in improper handling of connection upgrades within the asynchronous HTTP framework. AIOHTTP serves as a foundational library for building async web services and clients in Python, managing complex network interactions including WebSocket connections which rely on HTTP upgrade mechanisms. The core technical deficiency lies in the server's behavior when processing requests that initiate an upgrade protocol, such as transitioning from standard HTTP to WebSocket communication. During this transitional phase, where the connection is marked for upgrade but not yet fully established or accepted by the application handler, aiohttp buffers all incoming data without imposing any size limits or implementing flow control mechanisms. This design oversight allows a remote attacker to exploit the unbounded buffer by streaming large volumes of data behind an upgrade request. Since the server continues to accumulate this data in memory while waiting for the application layer to explicitly accept or reject the connection, it creates a direct pathway for resource depletion.
From an operational perspective, this flaw enables a straightforward denial-of-service attack vector that does not require authentication or complex exploitation techniques beyond establishing a valid HTTP upgrade request and subsequently flooding the connection with payload data. The impact is characterized by unbounded memory consumption on the server side. As the attacker continues to stream data, the process responsible for handling aiohttp requests will consume increasing amounts of system RAM until it either crashes due out-of-memory conditions or causes significant performance degradation that affects other services running on the same host. This type of vulnerability undermines the availability pillar of the CIA triad and can lead to service interruptions in production environments where high concurrency is expected, particularly for applications relying heavily on real-time communication features like chat systems, live updates, or streaming data feeds.
In terms of industry standard classifications, this issue aligns with CWE-400, which describes uncontrolled resource consumption within a single process or thread. The attack pattern corresponds to ATT&CK technique T1498, specifically Network Denial of Service via volumetric attacks, as it involves overwhelming the target system's resources through sustained data transmission rather than exploiting logic flaws in authentication or authorization. The lack of flow control during the upgrade handshake phase is a common pitfall in asynchronous frameworks that prioritize throughput over resource safety by default, making this a significant concern for developers building scalable network services.
Mitigation strategies primarily involve upgrading to aiohttp version 3.14.4 or later, where the buffering behavior has been corrected to include size limits and flow control mechanisms that prevent unbounded memory growth during upgrade transitions. For organizations unable to immediately patch their dependencies, defensive measures should be implemented at the network perimeter using web application firewalls or reverse proxies such as Nginx or HAProxy. These intermediary layers can enforce strict connection timeouts, limit request body sizes, and monitor for anomalous data rates during handshake phases before traffic reaches the Python application server. Additionally, developers should implement custom middleware that monitors memory usage per connection and aggressively terminates sessions exhibiting abnormal resource consumption patterns, thereby adding a layer of resilience against such volumetric attacks even if underlying library vulnerabilities persist in older versions.