AIOHTTP · GHSA-xgw8-8ccx-rmqh · Package
FIX → 3.14.4
aiohttp's Request.post() accepted any number of fields in a URL-encoded form body, and inserting many repeated keys into a MultiDict takes quadratic time. An attacker can send one form POST within the default client_max_size and block the event loop, stalling the whole server.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any aiohttp server whose handlers call Request.post() on a URL-encoded form body is exposed, because the attacker's form POST reaches that code within the default client_max_size. Services that only serve GET requests, or that parse forms some other way, are not affected by this path.
Not affected if multipart-only, no-form-post-handlers
Who cares aiohttp, python, self-hosted
pip show aiohttpRequest.post() on a URL-encoded form bodyUpgrade to 3.14.4
3.14.4Request.post() had no limit on the number of fields in a URL-encoded form body. Inserting a large number of repeated keys into a MultiDict took quadratic time on the event loop.
An attacker could block the event loop with a form POST within the default client_max_size to any handler that calls Request.post().
Patch: https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.