Bug 2573475 (CVE-2026-128128) - CVE-2026-128128 aiohttp: aiohttp: Denial of Service via integer overflow in WebSocket reader
Summary: CVE-2026-128128 aiohttp: aiohttp: Denial of Service via integer overflow in W...
Keywords:
Status: NEW
Alias: CVE-2026-128128
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-13 20:41 UTC by OSIDB Bzimport
Modified: 2026-11-13 20:50 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-13 20:41:42 UTC 
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader adds a declared frame length to the size of an already buffered partial message using signed 64-bit arithmetic. A length near two to the power of 63 can overflow, allowing the max_msg_size check to pass. A remote peer can send a small non-final fragment followed by an oversized message and cause unbounded memory consumption. The Python WebSocket reader is unaffected. This issue is fixed in version 3.14.4.
Note You need to log in before you can comment on or make changes to this bug.