Detections
Analytics
CVE-2026-128131
high
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty members produce no output, so client_max_size and output backpressure do not limit the work. A remote attacker can block a server event loop with a crafted compressed request body or WebSocket message, and a malicious server can similarly block a client. This issue is fixed in version 3.14.4.
References
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-h4cc-hm5h-fmm9
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
https://github.com/aio-libs/aiohttp/pull/13391
https://github.com/aio-libs/aiohttp/pull/13362
https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db
https://github.com/aio-libs/aiohttp/commit/d041d4d0fd48c3f0832084d33be16cf1c4835f85