CVE-2026-128131AIOHTTP: Concatenated compressed streams cause excessive CPU use

Descripción

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty members produce no output, so client_max_size and output backpressure do not limit the work. A remote attacker can block a server event loop with a crafted compressed request body or WebSocket message, and a malicious server can similarly block a client. This issue is fixed in version 3.14.4.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-h4cc-hm5h-fmm9
• https://github.com/aio-libs/aiohttp/pull/13362
• https://github.com/aio-libs/aiohttp/pull/13391
• https://github.com/aio-libs/aiohttp/commit/d041d4d0fd48c3f0832084d33be16cf1c4835f85
• https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db
• https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4