AIOHTTP hat eine verzögerte Größenüberprüfung für nicht-Dateimultipartfelder, was zu einem Memory DoS führt

The primary impact of CVE-2026-34517 is a denial-of-service condition. An attacker can leverage this vulnerability to exhaust server resources by sending numerous malicious multipart requests. Each request triggers a large memory allocation within the aiohttp framework, potentially leading to application slowdown, instability, or even a crash. While the CVSS score is LOW, the cumulative effect of multiple attacks could still disrupt service availability. The vulnerability stems from a flaw in how aiohttp handles multipart form fields; it reads the entire field into memory before validating the clientmaxsize parameter, creating an opportunity for exploitation.

Applications utilizing aiohttp for handling multipart form data, particularly those deployed in public-facing environments or handling untrusted user input, are at risk. Services relying on aiohttp for processing file uploads or other large data submissions are also vulnerable. Legacy systems running older versions of aiohttp without robust input validation are especially susceptible.

• python / server:

ps aux | grep aiohttp | grep -i 'multipart'

• python / server:

import psutil

# Monitor memory usage of aiohttp processes
for proc in psutil.process_iter(['pid', 'name', 'memory_info']):
    if 'aiohttp' in proc.info['name'].lower():
        memory_usage = proc.info['memory_info'].rss / (1024 * 1024)  # in MB
        print(f'aiohttp process {proc.pid}: Memory usage = {memory_usage:.2f} MB')

1. 2026-04-01Disclosure

   disclosure

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-01
3. Geändert2026-04-02
4. EPSS aktualisiert2026-04-09

The recommended mitigation for CVE-2026-34517 is to upgrade to aiohttp version 3.13.4 or later. This version includes a fix that prevents the excessive memory allocation. If upgrading immediately is not feasible, consider implementing rate limiting on multipart form submissions to reduce the impact of potential attacks. Additionally, carefully review application code that utilizes Request.post() and ensure proper input validation and size limits are enforced. The fix involves checking the clientmaxsize before reading the entire multipart field into memory, preventing the memory exhaustion issue. After upgrading, confirm the fix by sending a large multipart request and verifying that memory usage remains within acceptable limits.