{"affected":[{"product":"aiohttp","source":"CNA: GitHub_M","vendor":"aio-libs","versions":[{"status":"affected","version":"< 3.14.4"}]}],"cveId":"CVE-2026-128124","cwes":["CWE-1333"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.add_domain() converts every asterisk wildcard in a domain mask into a greedy regular-expression fragment, so a mask containing two or more wildcards can take polynomial time to reject a long Host header that does not match. A remote attacker can repeatedly send such headers to a server configured with a multi-wildcard domain mask and stall the event loop. This issue is fixed in version 3.14.4.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794601356733,"publishedAt":1794601356733,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jm3w-gw2p-xjfj"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aio-libs/aiohttp/pull/13943"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aio-libs/aiohttp/pull/13945"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aio-libs/aiohttp/commit/766b882820da0651c84090e366a3b024b4a263c9"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"remediation":[],"revision":"1356f74e411e318c9fb6b96ea5828b777b2ad99dc14887f37faceacc62ae0044","sources":[{"modifiedAt":1794601356733,"name":"CNA: GitHub_M","retrievedAt":1794604205618,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128124"}],"ssvc":null,"status":"published","title":"AIOHTTP: Event loop stall in add_domain() wildcard matching","updatedAt":1794604205618}