Denial of Service Vulnerability in AIOHTTP: Excessive CPU Blocking through Chunked Messages
Summary
GHSA-g84x-mcqj-x9qq: AIOHTTP vulnerable to DoS through chunked messages. Affects aiohttp versions < 3.13.3. Fixed in 3.13.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AIOHTTP is a popular asynchronous HTTP client/server framework for Python, designed to handle asynchronous requests efficiently. It allows developers to build web applications and services that can handle multiple connections simultaneously. However, a recent vulnerability has been identified that affects its ability to process chunked messages, potentially leading to denial of service (DoS) conditions.
Vulnerability Detail
The vulnerability arises from the handling of chunked messages in AIOHTTP, specifically when the 'request.read()' method is used in an endpoint. An attacker can exploit this by sending a large number of chunks, causing the server to spend excessive CPU time processing the request. This blocking behavior can prevent the server from handling other incoming requests, leading to a denial of service. The vulnerability is classified under CWE-770, indicating that it can lead to resource exhaustion.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.3
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.13.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the size of incoming requests or implement rate limiting on your server to mitigate the impact of this vulnerability until you can apply the patch.
Conclusion
In summary, the AIOHTTP package is vulnerable to denial of service attacks through the mishandling of chunked messages. It is crucial for developers using this package to update to the latest version to protect their applications from potential exploits. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for aiohttp →
FAQ
The CVSS score of this vulnerability is 6.6, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
Chunked messages are a way of sending data in a series of chunks, allowing the server to start processing the request before the entire message is received.
The main impact is denial of service, where the server becomes unresponsive due to excessive CPU usage while processing malicious requests.
Yes, version 3.13.3 and later of AIOHTTP contains the necessary patches to mitigate this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
