---
id: "GHSA-3rp8-rxj8-mvjw"
page: "https://infrastack.ai/live/GHSA-3rp8-rxj8-mvjw"
kind: "vulnerability"
aliases: ["GHSA-3rp8-rxj8-mvjw"]
title: "WebSocket max_msg_size bypass via integer overflow"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "aiohttp", "fixed": ["3.14.4"], "affected": "<= 3.14.3", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["aiohttp", "cwe-770", "package", "python", "self-hosted", "websocket"]
not_affected_if: ["no-websocket-endpoints", "patched-3.14.4", "python-reader-only"]
published_at: "2026-11-08T18:20:46+00:00"
first_seen_at: "2026-11-09T22:53:22+00:00"
updated_at: "2026-11-09T22:54:19+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3rp8-rxj8-mvjw", "first_seen_at": "2026-11-09T22:53:22+00:00"}]
exploit_sources: []
---

# WebSocket max_msg_size bypass via integer overflow

Link for people: https://infrastack.ai/live/GHSA-3rp8-rxj8-mvjw (this .md is for agents)

aiohttp's WebSocket reader in its C extension miscalculates the size check for a declared frame length, so a very large declared length passes the max_msg_size limit. An attacker can stream an oversized message after a small non-final fragment and drive the server into unbounded memory use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:aiohttp affected <= 3.14.3 fixed 3.14.4

## How to check

- Check the installed version with `pip show aiohttp`; versions at or below `3.14.3` are affected.
- Check whether the C extension is in use: if `AIOHTTP_NO_EXTENSIONS` is not set, the C reader is active.
- Check whether the app accepts WebSocket connections from untrusted clients.

## Fix

- aiohttp: move to `3.14.4`
- Workaround from the advisory: set `AIOHTTP_NO_EXTENSIONS=1` to use the Python reader, which is stated to be unaffected.

## Timeline

- 2026-11-09T22:53:22+00:00 ghsa-repo https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3rp8-rxj8-mvjw

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3rp8-rxj8-mvjw

## From the sources

### Summary

The `max_msg_size` check in the WebSocket reader added the declared frame length to the size of the partial message already buffered. In the C extension this addition is 64-bit arithmetic, so a declared length close to 2**63 overflowed and the check passed.

### Impact

An attacker could bypass `max_msg_size` and cause unbounded memory use by streaming an oversized WebSocket message after a small non-final fragment.

### Workaround

If unable to upgrade, the Python reader is unaffected and can be used with `AIOHTTP_NO_EXTENSIONS=1`.

---

Patch: https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_