CVE-2026-128128

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader adds a declared frame length to the size of an already buffered partial message using signed 64-bit arithmetic. A length near two to the power of 63 can overflow, allowing the...

CVE-2026-128128

The AIOHTTP asynchronous HTTP framework is vulnerable to an integer overflow in its C WebSocket reader prior to version 3.14.4 . The vulnerability occurs because the reader uses signed 64-bit arithmetic to add a declared frame length to a buffered partial message. A length near $2^{63}$ can cause...