Excessive memory and CPU use in aiohttp on crafted requests
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-770.
Summary
aiohttp from 0 before 3.14.4 can use excessive or unbounded memory and CPU when handling attacker-controlled requests. The flaw is an allocation of resources without limits or throttling (CWE-770). An attacker can exhaust server resources by sending specially crafted requests.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the GitHub advisory
### Summary Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests. ### Impact An attacker could cause resource exhaustion through specially crafted requests.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | aiohttp (PyPI) | before 3.14.4 | 3.14.4 | Patch available | GHSA-2g87-pp6c-29x5 |
- aiohttp (PyPI) Vendor— Affected before 3.14.4 Fixed in 3.14.4 Patch available GHSA-2g87-pp6c-29x5
Remediation
Upgrade aiohttp (PyPI) to version 3.14.4.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · GHSA-2g87-pp6c-29x5 aiohttp (PyPI) Fixed in 3.14.4 Advisory →
Timeline
- 2026-10-20 Threatist record created from GHSA-2g87-pp6c-29x5
References
Other 14
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2g87-pp6c-29x5
- https://github.com/aio-libs/aiohttp/commit/09bcaa73ff084a0c539bbf16a0a78743acb7141f
- https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6
- https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df
- https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7
- https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53
- https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa
- https://github.com/aio-libs/aiohttp/commit/6a4f6682817839313b04b8e5cea2b39c1a88ab4f
- https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab
- https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd
- https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43
- https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db
- https://github.com/aio-libs/aiohttp
- https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences