GitHub Advisoryadvisory · PyPI

GHSA-m5qp-6w8w-w647 AIOHTTP has a Multipart Header Size Bypass

MEDIUM Published 2026-04-01 Modified 2026-04-06 Official page ↗
Aliases
CVE-2026-34516
Ecosystem
PyPI
Packages
aiohttp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2026-04-01

Affected packages

• PyPI aiohttp: < 3.13.4 → fixed in 3.13.4

Description

Summary A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. Impact Multipart headers were not subject to the same size restrictions in place for normal headers, potentially allowing substantially more data to be loaded into memory than intended. However, other restrictions in place limit the impact of this vulnerability. ----- Patch: https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f

Related

Alias · CVE (1)

  • CVE-2026-34516 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References