AIOHTTP · GHSA-24c4-3p7v-29cm · Package
FIX → 3.14.4
aiohttp's multipart reader keeps reading base64-encoded parts without a byte limit until the chunk length is a multiple of four. A crafted multipart request can make the server load the whole remaining body into memory or block the event loop.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built on aiohttp that accept multipart uploads through a request handler are exposed, because the flaw is in how the multipart reader decodes base64 parts. Services that do not read multipart request bodies, or that run an aiohttp version above 3.14.3, can skip it.
Not affected if fixed-version, no-multipart-handlers
Who cares aiohttp, python, self-hosted
pip show aiohttp and see whether it is 3.14.3 or older.multipart() or read BodyPartReader data from request bodies.Upgrade to 3.14.4
aiohttp When reading a multipart part with Content-Transfer-Encoding: base64, BodyPartReader.read_chunk() kept reading until the chunk length was a multiple of 4, with no byte limit. A part with a short Content-Length, or a long run of whitespace, could cause the entire remaining body to be read into memory within a single call before any size check, or spin on the event loop.
An attacker could bypass client_max_size to cause excessive memory use, or block the event loop, with a specially crafted multipart request to any handler that reads multipart data.
Patch: https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.14.4