AIOHTTP · GHSA-28qf-cpwq-vmc2 · Package
FIX → 3.14.4
When the pipelined request queue is full, the pure-Python HTTP parser keeps the unparsed remainder and also returns it to the caller, so after a declined upgrade the data is re-fed. An attacker can make the buffer grow with each request and get already-handled requests dispatched to the application again.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use aiohttp with the pure-Python parser, which happens when AIOHTTP_NO_EXTENSIONS is set or when no standard wheel with the C extension was installed. Servers that use the default C parser are not affected according to the maintainer's workaround. Applications that handle connection upgrade requests and accept pipelined requests are the most exposed.
Not affected if c-parser, standard-wheel
Who cares aiohttp, python, web-servers
python -c "import aiohttp; print(aiohttp.__version__)" and confirm it is 3.14.3 or lower.python -c "from aiohttp import http_parser; print(http_parser.HttpRequestParser)" and look for a pure-Python class instead of the C one.AIOHTTP_NO_EXTENSIONS is set in the environment or deployment config.When the pipelined request queue was full, the pure-Python parser stored the unparsed remainder internally and also returned it to the caller. After a handler declined an upgrade request, the buffered data was re-fed, so the buffer grew with each handled request and already-handled requests were dispatched to the application again.
If users are using the Python parser (AIOHTTP_NO_EXTENSIONS, or not a standard wheel installed), an attacker could cause excessive memory use and cause pipelined requests to be processed more than once.
Switch to the default C parser.
Patch: https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 3.14.4
aiohttp 3.14.4