CVE-2026-128131
AIOHTTP: Concatenated compressed streams cause excessive CPU use
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty members produce no output, so client_max_size and output backpressure do not limit the work. A remote attacker can block a server event loop with a crafted compressed request body or WebSocket message, and a malicious server can similarly block a client. This issue is fixed in version 3.14.4.
| CWE | CWE-400 CWE-407 |
| Vendor | aio-libs |
| Product | aiohttp |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for aio-libs aiohttp
Be the first to know when new unknown vulnerabilities affecting aio-libs aiohttp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
aio-libs / aiohttp
< 3.14.4
References
github.com: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-h4cc-hm5h-fmm9 github.com: https://github.com/aio-libs/aiohttp/pull/13362 github.com: https://github.com/aio-libs/aiohttp/pull/13391 github.com: https://github.com/aio-libs/aiohttp/commit/d041d4d0fd48c3f0832084d33be16cf1c4835f85 github.com: https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db github.com: https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4