GHSA-3WQ7-RQQ7-WX6J AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

Summary For some multipart form fields, aiohttp read the entire field into memory before checking clientmaxsize. Impact If an application uses Request.post an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimate...

botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2026-34517 via aiohttp (1.1.6)

aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2026-34517 Source advisory: OSV:GHSA-3WQ7-RQQ7-WX6J...

opentrons (>=3.7.0, <=3.11.4) potentially affected by CVE-2026-34517 via aiohttp (2.3.8)

aiohttp PYPI version 2.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - opentrons =3.7.0, =3.11.4 Source cves: CVE-2026-34517 Source advisory: OSV:GHSA-3WQ7-RQQ7-WX6J...

homeassistant (>=0.58.0, <=0.58.1), pyplanet (>=0.5.0, <=0.5.2) +1 more potentially affected by CVE-2026-34517 via aiohttp (2.3.2)

aiohttp PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.58.0, =0.5.0, =0.6.0, =0.6.2 Source cves: CVE-2026-34517 Source advisory: OSV:GHSA-3WQ7-RQQ7-WX6J...

hassmart-homeassistant (0.60.0), homeassistant (>=0.60.0, <=0.60.1) +2 more potentially affected by CVE-2026-34517 via aiohttp (2.3.6)

aiohttp PYPI version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hassmart-homeassistant 0.60.0 - homeassistant =0.60.0, =0.60.1 - pyplanet 0.5.4 - reliz 0.1.0.dev0 Source cves: CVE-2026-34517 Source advisory:...

hdx-data-freshness (>=1.0.5, <=1.1.2), pyplanet (>=0.6.0rc1, <=0.10.5) potentially affected by CVE-2026-34517 via aiohttp (2.3.9)

aiohttp PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hdx-data-freshness =1.0.5, =0.6.0rc1, =0.10.5 Source cves: CVE-2026-34517 Source advisory: OSV:GHSA-3WQ7-RQQ7-WX6J...

aioboto3 (2.2.0), aiobotocore (>=0.5.0, <=0.5.3) +56 more potentially affected by CVE-2026-34516 via aiohttp (2.3.10)

aiohttp PYPI version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 2.2.0 - aiobotocore =0.5.0, =0.8.4, =0.1.0a1, =1.0.0, =3.0.0b4, =2.0.0, =1.1.1, =1.2.1, =2.1.0, =0.8.22, =2.0.0, =2.0.13 and more Source...

aiohttp-cors (0.3.0), aslack (0.11.0) +1 more potentially affected by CVE-2026-34516 via aiohttp (0.20.2)

aiohttp PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiohttp-cors 0.3.0 - aslack 0.11.0 - muffin =0.5.2, =0.5.12 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

aiopixiv (>=1.0.0, <=1.0.4) potentially affected by CVE-2026-34516 via aiohttp (1.1.0)

aiohttp PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopixiv =1.0.0, =1.0.4 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

homeassistant (>=0.58.0, <=0.58.1), pyplanet (>=0.5.0, <=0.5.2) +1 more potentially affected by CVE-2026-34516 via aiohttp (2.3.2)

aiohttp PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.58.0, =0.5.0, =0.6.0, =0.6.2 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

muffin (>=0.10.0, <=0.10.2), mutaprops (>=0.6.0, <=0.6.1) potentially affected by CVE-2026-34516 via aiohttp (1.0.2)

aiohttp PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.10.0, =0.6.0, =0.6.1 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

muffin (0.5.1) potentially affected by CVE-2026-34516 via aiohttp (0.20.1)

aiohttp PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.1 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

muffin (0.5.0) potentially affected by CVE-2026-34516 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

muffin (>=0.1.1, <=0.1.4) potentially affected by CVE-2026-34516 via aiohttp (0.17.2)

aiohttp PYPI version 0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.1, =0.1.4 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

hassmart-homeassistant (>=0.59.2, <=0.59.2.1), homeassistant (>=0.59.0, <=0.59.2) potentially affected by CVE-2026-34516 via aiohttp (2.3.5)

aiohttp PYPI version 2.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hassmart-homeassistant =0.59.2, =0.59.0, =0.59.2 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2026-34516 via aiohttp (0.14.1)

aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2026-34516 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

aio-tinder (>=0.1.1, <=0.1.3), muffin (0.9.0) +3 more potentially affected by CVE-2026-34516 via aiohttp (0.22.5)

aiohttp PYPI version 0.22.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.1, =0.0.3, =0.1.0, =0.4.0 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

muffin (>=0.3.0, <=0.3.2) potentially affected by CVE-2026-34516 via aiohttp (0.18.3)

aiohttp PYPI version 0.18.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.0, =0.3.2 Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...

0x20bf (0.0.1), 2keys (0.5.1) +3262 more potentially affected by CVE-2026-34516 via aiohttp (>=3.0.0b0, <=3.13.3)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 - ab-data-processing 0.0.1 and more Source cves: CVE-2026-34516 Source advisory: OSV:GHSA-M5QP-6W8W-W647...