Vulnerability GHSA-2g87-pp6c-29x5
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 hours ago
October 19, 2026 at 05:07 PM UTC
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
0.1 - 3.14.3
0.1 - 3.14.3
Summary
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
Details
Summary
Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests.
Impact
An attacker could cause resource exhaustion through specially crafted requests.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 hours ago
aiohttp server lacks an initial request/header timeout
0.1 - 3.14.3 GHSA-5wr8-gcqf-gqf3
0.1 - 3.14.3 GHSA-5wr8-gcqf-gqf3
Low Risk
4 hours ago
AIOHTTP: Secure attribute not enforced for shared cookie
0.1 - 3.14.3 GHSA-494j-54xm-rwp3
0.1 - 3.14.3 GHSA-494j-54xm-rwp3
Unknown
2 months ago
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
0.1 - 3.14.2 PYSEC-2026-3545
0.1 - 3.14.2 PYSEC-2026-3545
Unknown
2 months ago
AIOHTTP: HTTP request smuggling via WebSocket upgrade
0.1 - 3.14.1 PYSEC-2026-3546
0.1 - 3.14.1 PYSEC-2026-3546
Unknown
2 months ago
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
0.1 - 3.14.1 PYSEC-2026-3547
0.1 - 3.14.1 PYSEC-2026-3547
Impacted packages
Timeline
Published
4 hours ago
October 19, 2026 at 05:07 PM UTC
Fixed (3.14.4)
14 days ago
October 05, 2026 at 05:38 PM UTC
Last Modified
3 hours ago
October 19, 2026 at 05:15 PM UTC