CVE-2026-34993

AIOHTTP, an asynchronous HTTP framework for asyncio and Python, versions 3.13.2 and below allow a crafted request to cause uncontrolled memory consumption on the server. If an application uses the Request.post() method in a handler, an attacker may freeze the server by exhausting memory. This issue is fixed in version 3.13.3.

AIOHTTP versions 3.13.2 and below contain a vulnerability that allows an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1) and the application includes a handler using Request.post(), an attacker may execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

AIOHTTP, an asynchronous HTTP client/server framework for Python, prior to version 3.14.3, has an out-of-bounds heap read vulnerability in the C response parser. While building an error message for a malformed response, an out-of-bounds read can occur, leading to DoS in the client. Fixed in version 3.14.3.

AIOHTTP prior to version 3.14.2 contains a request smuggling vulnerability related to WebSocket upgrades. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data.

AIOHTTP before 3.14.2 in the WebSocket client accepts and decompresses frames with the RSV1 bit set even without negotiating the permessage-deflate extension. A malicious server can cause unexpected CPU and memory consumption.

In the AIOHTTP library before version 3.14.1, a vulnerability allows bypassing the max_line_size check in HTTP requests when using the optimized C parser. An attacker can send oversized lines, causing excessive memory consumption and potentially leading to a DoS attack.

In AIOHTTP before version 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. The attack requires an open redirect vulnerability on the target domain, and the attacker only receives the digest, allowing credential extraction only if cryptography is weak or passwords are reused.

In AIOHTTP prior to version 3.14.0, cookies set via the `cookies` parameter are sent after a cross-origin redirect. If a developer uses the `cookies` parameter per-request, sensitive data might leak to an attacker controlling the redirect.

A vulnerability in AIOHTTP versions 3.13.2 and below allows a zip bomb attack that, upon decompression, can exhaust host memory and cause a DoS.

The vulnerability in aiohttp allows an attacker to modify an HTTP request or create a new one if they control the HTTP version. This issue only occurs if the attacker can control the HTTP version of the request.