CVE-2026-34517: AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

April 1, 2026

For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.

References

github.com/advisories/GHSA-3wq7-rqq7-wx6j
github.com/aio-libs/aiohttp
github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145
github.com/aio-libs/aiohttp/releases/tag/v3.13.4
github.com/aio-libs/aiohttp/security/advisories/GHSA-3wq7-rqq7-wx6j
nvd.nist.gov/vuln/detail/CVE-2026-34517

Code Behaviors & Features

Detect and mitigate CVE-2026-34517 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →