CVE-2026-128127

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.read_chunk() processing a multipart part with Content-Transfer-Encoding set to base64 keeps reading until the chunk length is a multiple of four without enforcing a byte limit. A short Content-Length or a long run of whitespace can cause one call to read the remaining body into memory before the size check or spin on the event loop. A remote attacker can send such a multipart request to a handler that reads multipart data and bypass client_max_size. This issue is fixed in version 3.14.4.

References

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-24c4-3p7v-29cm

https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4

https://github.com/aio-libs/aiohttp/pull/13513

https://github.com/aio-libs/aiohttp/pull/13509

https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd

https://github.com/aio-libs/aiohttp/commit/2d9c5c1062eff0034fb3ab120897a6c1b3ff7041

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4