Stats Digest Feeds
← Back to all CVEs

CVE-2026-128129

UNKNOWN NVD
CVSS Score 0
Severity UNKNOWN
Published Nov 13, 2026
Vendor unknown

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can stream data behind an upgrade request to a handler that does not immediately accept or reject the upgrade and cause unbounded memory consumption. This issue is fixed in version 3.14.4.

References