AIOHTTP présente une application tardive de la taille pour les champs multipart non-fichier, ce qui provoque une déni de service par manque de mémoire (DoS)

The primary impact of CVE-2026-34517 is a denial-of-service condition. An attacker can craft a multipart form submission that, despite being ultimately rejected due to size limitations, triggers a large memory allocation within the aiohttp server. This allocation can consume significant system resources, potentially impacting the availability of the application and even affecting other services running on the same server. While the CVSS score is LOW, the potential for resource exhaustion and service disruption should not be underestimated, particularly in high-traffic environments or those with limited resources. The vulnerability doesn't directly lead to data exfiltration or code execution, but it can effectively render the application unresponsive.

Applications utilizing aiohttp for handling multipart form data, particularly those deployed in public-facing environments or handling untrusted user input, are at risk. Services relying on aiohttp for processing file uploads or other large data submissions are also vulnerable. Legacy systems running older versions of aiohttp without robust input validation are especially susceptible.

• python / server:

ps aux | grep aiohttp | grep -i 'multipart'

• python / server:

import psutil

# Monitor memory usage of aiohttp processes
for proc in psutil.process_iter(['pid', 'name', 'memory_info']):
    if 'aiohttp' in proc.info['name'].lower():
        memory_usage = proc.info['memory_info'].rss / (1024 * 1024)  # in MB
        print(f'aiohttp process {proc.pid}: Memory usage = {memory_usage:.2f} MB')

1. 2026-04-01Disclosure

   disclosure

1. Réservé2026-03-30
2. Publiée2026-04-01
3. Modifiée2026-04-02
4. EPSS mis à jour2026-04-09

The recommended mitigation for CVE-2026-34517 is to upgrade to aiohttp version 3.13.4 or later, which includes a fix for the vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds such as rate limiting incoming requests, particularly multipart form submissions. Additionally, configure your web server or reverse proxy to limit the maximum size of multipart requests to prevent excessively large submissions. Monitoring server memory usage is also crucial to detect potential DoS attacks. After upgrading, confirm the fix by sending a large multipart request and verifying that memory allocation remains within acceptable limits.