AIOHTTP hat einen Multipart Header Size Bypass

The core of the vulnerability lies in the absence of size limitations for multipart headers within aiohttp. Standard HTTP headers are subject to size restrictions to prevent malicious actors from overwhelming the server with large amounts of data. However, multipart headers, used for transmitting complex data structures, were not similarly constrained. An attacker can exploit this by sending a request with a massive number of multipart headers, each containing a significant amount of data. This excessive data is loaded into memory, potentially exceeding available resources and causing the aiohttp application to crash or become unresponsive. While the vulnerability doesn't directly expose sensitive data, the resulting DoS can disrupt critical services and impact user experience. The blast radius is limited to the aiohttp application itself; however, if that application is a critical component of a larger system, the impact can be significant.

Applications relying on aiohttp for handling HTTP requests, particularly those deployed in public-facing environments or handling sensitive data, are at risk. Systems with older aiohttp versions (≤3.9.5) and those lacking robust rate limiting or WAF protection are especially vulnerable.

• python / server:

  # Check aiohttp version
  python -c "import aiohttp; print(aiohttp.__version__)"
  # Monitor memory usage with top/htop
  top

• generic web:

  # Check for unusually large headers in access logs (example)
  grep -i 'multipart' /var/log/nginx/access.log | head -n 10

1. 2026-04-01Disclosure

   disclosure

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-01
3. Geändert2026-04-06
4. EPSS aktualisiert2026-04-09

The primary mitigation for CVE-2026-34516 is to upgrade to aiohttp version 3.13.4 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. One approach is to configure a Web Application Firewall (WAF) or reverse proxy to inspect incoming requests and reject those with unusually large multipart headers. Specific WAF rules can be created to limit the number of headers or the total size of multipart data. Another potential workaround involves modifying the aiohttp configuration to impose stricter limits on header sizes, although this may require careful testing to avoid impacting legitimate requests. The patch itself involves enforcing size restrictions on multipart headers, preventing the excessive memory consumption that triggers the DoS. After upgrading, confirm the fix by sending a crafted request with a large number of multipart headers and verifying that the application handles it gracefully without crashing or experiencing performance degradation.