All vulnerabilities
GHSA-2g87-pp6c-29x5

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

aiohttppipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3.14.4Fixed versionGitHub
Published19 Oct 2026Updated 19 Oct 2026GitHub

What fixes it

  • 3.14.4aiohttp, pipGitHub
  • 3.14.4aiohttp, PyPIOSVpip install "aiohttp>=3.14.4"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests.

Impact

An attacker could cause resource exhaustion through specially crafted requests.

Text from GitHub Advisory Database

Affected versions 52

  • aiohttp, pip<= 3.14.3GitHub
  • aiohttp, PyPIfrom first release, fixed in 3.14.4OSV
  • aiohttp, PyPI0.1OSV
  • aiohttp, PyPI0.10.0OSV
  • aiohttp, PyPI0.10.1OSV
  • aiohttp, PyPI0.10.2OSV
  • aiohttp, PyPI0.11.0OSV
  • aiohttp, PyPI0.12.0OSV
  • aiohttp, PyPI0.13.0OSV
  • aiohttp, PyPI0.13.1OSV
  • aiohttp, PyPI0.14.0OSV
  • aiohttp, PyPI0.14.1OSV
  • aiohttp, PyPI0.14.2OSV
  • aiohttp, PyPI0.14.3OSV
  • aiohttp, PyPI0.14.4OSV
  • aiohttp, PyPI0.15.0OSV
  • aiohttp, PyPI0.15.1OSV
  • aiohttp, PyPI0.15.2OSV
  • aiohttp, PyPI0.15.3OSV
  • aiohttp, PyPI0.16.0OSV
  • aiohttp, PyPI0.16.1OSV
  • aiohttp, PyPI0.16.2OSV
  • aiohttp, PyPI0.16.3OSV
  • aiohttp, PyPI0.16.4OSV
  • aiohttp, PyPI0.16.5OSV
  • aiohttp, PyPI0.16.6OSV
  • aiohttp, PyPI0.17.0OSV
  • aiohttp, PyPI0.17.1OSV
  • aiohttp, PyPI0.17.2OSV
  • aiohttp, PyPI0.17.3OSV
  • aiohttp, PyPI0.17.4OSV
  • aiohttp, PyPI0.18.0OSV
  • aiohttp, PyPI0.18.1OSV
  • aiohttp, PyPI0.18.2OSV
  • aiohttp, PyPI0.18.3OSV
  • aiohttp, PyPI0.18.4OSV
  • aiohttp, PyPI0.19.0OSV
  • aiohttp, PyPI0.2OSV
  • aiohttp, PyPI0.20.0OSV
  • aiohttp, PyPI0.20.1OSV
  • aiohttp, PyPI0.20.2OSV
  • aiohttp, PyPI0.21.0OSV
  • aiohttp, PyPI0.21.1OSV
  • aiohttp, PyPI0.21.2OSV
  • aiohttp, PyPI0.21.4OSV
  • aiohttp, PyPI0.21.5OSV
  • aiohttp, PyPI0.21.6OSV
  • aiohttp, PyPI0.22.0OSV
  • aiohttp, PyPI0.22.0a0OSV
  • aiohttp, PyPI0.22.0b0OSV
  • aiohttp, PyPI0.22.0b1OSV
  • aiohttp, PyPI0.22.0b2OSV

References 14