GHSA-2g87-pp6c-29x5

Summary

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

Severity

high

CWE

CWE-770

Published

2026-10-19

Updated

2026-10-19

Advisory details

Summary

Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests.

Impact

An attacker could cause resource exhaustion through specially crafted requests.

References

• https://github.com/advisories/GHSA-2g87-pp6c-29x5
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2g87-pp6c-29x5
• https://github.com/aio-libs/aiohttp/commit/09bcaa73ff084a0c539bbf16a0a78743acb7141f
• https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6
• https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df
• https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7
• https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53
• https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa

Related advisories

• CVE-2026-111066 — high · PyPI/aiohttp
• CVE-2026-111064 — high · PyPI/aiohttp
• CVE-2026-111065 — medium · PyPI/aiohttp
• CVE-2026-69244 — high · PyPI/aiohttp
• CVE-2026-111748 — medium · PyPI/aiohttp
• CVE-2026-111750 — medium · PyPI/aiohttp
• CVE-2026-69243 — medium · PyPI/aiohttp
• CVE-2026-59881 — medium · PyPI/aiohttp

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity