~ / search / GHSA-3wq7-rqq7-wx6j

GHSA-3wq7-rqq7-wx6j

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

Source: GitHub Advisory Database (reviewed) Low CVE-2026-34517

Packages

EcosystemPackageAffectedFixed in
PyPI aiohttp < 3.13.4 3.13.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. ### Impact If an application uses `Request.post()` an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected. ----- Patch: https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145

References

External links from the advisory. They lead to third-party sites.