UNKNOWN PyPI
AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS
GHSA-3wq7-rqq7-wx6j · CVE-2026-34517 · PYSEC-2026-2099
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Summary
For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.
Impact
If an application uses Request.post() an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected.
Patch: https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145
References
- WEB https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3wq7-rqq7-wx6j
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34517
- WEB https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145
- PACKAGE https://github.com/aio-libs/aiohttp
- WEB https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4
Ready to move
Start Securing
Free, no credit card | First findings in minutes