AIOHTTP · GHSA-pw86-h8fm-j323 · Package
FIX → 3.14.4
While a request marked as an upgrade, such as a WebSocket handshake, is being handled, aiohttp buffers all further data on the connection with no size limit until the handler finishes. An attacker who streams data behind such a request can drive the server's memory use without bound.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that run an aiohttp server and expose handlers reachable by clients that send upgrade requests, such as WebSocket endpoints, where the handler does not immediately accept or reject the upgrade. Client-only use of aiohttp and servers that do not serve upgrade requests are not described as affected.
Not affected if client-only, no-upgrade-handlers
Who cares aiohttp, python, self-hosted, websocket
pip show aiohttp and confirm whether it is 3.14.3 or older.Upgrade to 3.14.4
aiohttp 3.14.4While a request flagged as an upgrade (e.g. a WebSocket handshake) was being handled, all further data received on the connection was buffered with no size limit or flow control until the handler completed.
An attacker could cause unbounded memory use by streaming data behind an upgrade request to any handler that does not immediately accept or reject the upgrade.
Patch: https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.