HIGHCVSS 8.7

GHSA-2g87-pp6c-29x5

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

Published: 2026-10-19
Modified: 2026-10-19
Sources: github-advisory

Summary

### Summary Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests. ### Impact An attacker could cause resource exhaustion through specially crafted requests.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	aiohttp	—	3.14.4

Remediation: Upgrade to 3.14.4 or later.

References

https://github.com/advisories/GHSA-2g87-pp6c-29x5

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.