AIOHTTP · GHSA-jm3w-gw2p-xjfj · Package
FIX → 3.14.4
aiohttp's add_domain() compiled each wildcard in a host mask to a pattern that backtracks badly. With two or more wildcards, a long Host header that does not match the mask takes polynomial time to reject, blocking the event loop.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that call Application.add_domain() with a host mask containing two or more * wildcards are exposed. An attacker must send requests with long Host headers to a server that does so. Apps that do not use add_domain() or use at most one wildcard per mask can skip it.
Not affected if no-add-domain, single-wildcard-masks
Who cares aiohttp, python, web-servers
pip show aiohttp to read the installed versionadd_domain( and count * characters in each mask stringUpgrade to 3.14.4
Application.add_domain() compiled each * in a host mask to [^:]*. With two or more wildcards in a mask, matching a long Host header that does not match the mask took polynomial time on the event loop.
An attacker could stall a server that registers a domain mask with more than one wildcard by sending requests with a long Host header.
Use at most one * in a domain mask.
Patch: https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.14.4