CVE-2026-128127

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.readchunk processing a multipart part with Content-Transfer-Encoding set to base64 keeps reading until the chunk length is a multiple of four without enforcing a byte limit. A short...

CVE-2026-128127

The AIOHTTP asynchronous HTTP framework for Python and asyncio is vulnerable to a memory exhaustion or event loop spinning issue in versions prior to 3.14.4 . The root cause lies in the BodyPartReader.read_chunk() function, which fails to enforce a byte limit when processing multipart parts with ...