AIOHTTP · GHSA-5rmc-48h2-hvcm · Package
FIX → 3.14.4
aiohttp's WebSocket reader keeps parsing frames after its receive queue has paused, and empty or compressed messages do not count toward the queue size. An attacker can send many small or compressed messages to make a WebSocket server or client use excessive memory.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications using aiohttp WebSockets (server or client) that receive messages from untrusted peers. Applications that do not use WebSockets, or only talk to trusted peers, are less exposed.
Not affected if no-websocket-use, trusted-peers-only
Who cares aiohttp, python, websocket
pip show aiohttp and compare it to the affected range <= 3.14.3.Upgrade to 3.14.4
aiohttp 3.14.4The WebSocket reader continued parsing frames already received after the receive queue had paused the transport, and empty messages were not counted towards the queue size. With permessage-deflate, a single read of compressed frames could add many megabytes of decompressed messages to the queue.
An attacker could cause excessive memory use in a WebSocket server, or a malicious server against a client, by sending many small or compressed messages faster than the application consumes them.
Patch: https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.