CVE-2026-34517: AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS
Published Apr 1, 2026
·Updated
### Summary For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. ### Impact If an application uses `Request.post()` an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected. ----- Patch: https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145
Affected Software
2 affected componentsFixes available
pip/aiohttp<=3.13.3
3.13.4
aiohttp aiohttp<3.13.4
Remediation
Event History
Apr 1, 2026
CVE Published
via MITRE·08:14 PM
Data Sourced
via MITRE·08:14 PM
DescriptionWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 PM
RemedyAffected Software
Advisory Published
via GitHub·09:47 PM
Data Sourced
via GitHub·09:47 PM
DescriptionWeaknessAffected Software