{"id":"GHSA-2g87-pp6c-29x5","kind":"vulnerability","aliases":["GHSA-2g87-pp6c-29x5"],"related":[],"title":"aiohttp: Multiple instances of excessive or unbounded memory/CPU use","description":"### Summary\n\nMultiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests.\n\n### Impact\n\nAn attacker could cause resource exhaustion through specially crafted requests.","summary":"aiohttp, a Python async HTTP library, can use unbounded memory or excessive CPU when handling attacker-crafted requests. An attacker can exhaust server resources and degrade or crash the service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"aiohttp","fixed":["3.14.4"],"affected":"<= 3.14.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["aiohttp","cwe-770","package","python","self-hosted"],"not_affected_if":["version-above-3.14.3"],"how_to_check":"Run pip show aiohttp or pip freeze | grep aiohttp to read the installed version; affected if 3.14.3 or lower.","fix":"Upgrade aiohttp to 3.14.4 or later.","status":"open","published_at":"2026-10-19T17:07:23+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:15:34+00:00","updated_at":"2026-10-23T20:15:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:15:34Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade aiohttp to 3.14.4 or later.","summary":"aiohttp, a Python async HTTP library, can use unbounded memory or excessive CPU when handling attacker-crafted requests. An attacker can exhaust server resources and degrade or crash the service.","category":"package","who_cares":["python","aiohttp","self-hosted"],"confidence":0.8,"analyst_note":"","how_to_check":"Run pip show aiohttp or pip freeze | grep aiohttp to read the installed version; affected if 3.14.3 or lower.","needs_analyst":false,"not_affected_if":["version-above-3.14.3"],"severity_if_unknown":"high"},"cost_usd":0.000323,"input_tokens":2028,"output_tokens":240,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-770':23B '29x5':14A,19A '2g87':12A,17A 'aiohttp':1A,20A,21B,29B,66C 'async':32B 'attack':45B,49B,78C,83C 'attacker-craft':44B 'case':62C 'caus':85C 'consumpt':76C 'control':79C 'could':67C,84C 'cpu':41B,75C 'craft':46B,90C 'crash':57B 'cwe':22B 'degrad':55B 'excess':5A,40B,69C,74C 'exhaust':51B,87C 'found':64C 'ghsa':11A,16A 'ghsa-2g87-pp6c-29x5':10A,15A 'handl':43B 'host':28B 'http':33B 'impact':81C 'instanc':3A 'librari':34B 'memori':38B,72C 'memory/cpu':8A 'multipl':2A,61C 'packag':24B 'pp6c':13A,18A 'python':25B,31B 'request':47B,80C,91C 'resourc':53B,86C 'self':27B 'self-host':26B 'server':52B 'servic':59B 'special':89C 'summari':60C 'unbound':7A,37B,71C 'use':9A,36B,68C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:07:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-2g87-pp6c-29x5","url":"https://github.com/advisories/GHSA-2g87-pp6c-29x5","severity":"high","published_at":"2026-10-19T17:07:23+00:00","modified_at":"2026-10-19T17:07:24+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}