---
id: "GHSA-pw86-h8fm-j323"
page: "https://infrastack.ai/live/GHSA-pw86-h8fm-j323"
kind: "vulnerability"
aliases: ["GHSA-pw86-h8fm-j323"]
title: "Unbounded buffering of data received during an upgrade request"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "aiohttp", "fixed": ["3.14.4"], "affected": "<= 3.14.3", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["aiohttp", "cwe-770", "package", "python", "self-hosted", "websocket"]
not_affected_if: ["client-only", "no-upgrade-handlers"]
published_at: "2026-11-08T18:19:25+00:00"
first_seen_at: "2026-11-09T22:53:22+00:00"
updated_at: "2026-11-09T22:58:36+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pw86-h8fm-j323", "first_seen_at": "2026-11-09T22:53:22+00:00"}]
exploit_sources: []
---

# Unbounded buffering of data received during an upgrade request

Link for people: https://infrastack.ai/live/GHSA-pw86-h8fm-j323 (this .md is for agents)

While a request marked as an upgrade, such as a WebSocket handshake, is being handled, aiohttp buffers all further data on the connection with no size limit until the handler finishes. An attacker who streams data behind such a request can drive the server's memory use without bound.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:aiohttp affected <= 3.14.3 fixed 3.14.4

## How to check

- Check the installed version with `pip show aiohttp` and confirm whether it is `3.14.3` or older.
- Look for applications that use aiohttp servers with WebSocket or other upgrade handlers that do not accept or reject the upgrade immediately.

## Fix

- `aiohttp` `3.14.4`

## Timeline

- 2026-11-09T22:53:22+00:00 ghsa-repo https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pw86-h8fm-j323

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pw86-h8fm-j323

## From the sources

### Summary

While a request flagged as an upgrade (e.g. a WebSocket handshake) was being handled, all further data received on the connection was buffered with no size limit or flow control until the handler completed.

### Impact

An attacker could cause unbounded memory use by streaming data behind an upgrade request to any handler that does not immediately accept or reject the upgrade.

---

Patch: https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_