aio-libs aiohttp up to 3.14.3 BodyPartReader BodyPartReader.read_chunk resource consumption

Summaryinfo

A vulnerability labeled as problematic has been found in aio-libs aiohttp up to 3.14.3. This impacts the function BodyPartReader.read_chunk of the component BodyPartReader. Executing a manipulation can lead to resource consumption. The identification of this vulnerability is CVE-2026-128127. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in aio-libs aiohttp up to 3.14.3 and classified as problematic. This vulnerability affects the function BodyPartReader.read_chunk of the component BodyPartReader. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource. As an impact it is known to affect availability. CVE summarizes:

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.read_chunk() processing a multipart part with Content-Transfer-Encoding set to base64 keeps reading until the chunk length is a multiple of four without enforcing a byte limit. A short Content-Length or a long run of whitespace can cause one call to read the remaining body into memory before the size check or spin on the event loop. A remote attacker can send such a multipart request to a handler that reads multipart data and bypass client_max_size. This issue is fixed in version 3.14.4.

The advisory is available at github.com. This vulnerability was named CVE-2026-128127 since 11/12/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 3.14.4 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• aio-libs

Name

• aiohttp

Version

• 3.14.0
• 3.14.1
• 3.14.2
• 3.14.3

Website

• Product: https://github.com/aio-libs/aiohttp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion