{"affected":[{"product":"aiohttp","source":"CNA: GitHub_M","vendor":"aio-libs","versions":[{"status":"affected","version":"< 3.14.4"}]}],"cveId":"CVE-2026-128127","cwes":["CWE-400"],"description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.read_chunk() processing a multipart part with Content-Transfer-Encoding set to base64 keeps reading until the chunk length is a multiple of four without enforcing a byte limit. A short Content-Length or a long run of whitespace can cause one call to read the remaining body into memory before the size check or spin on the event loop. A remote attacker can send such a multipart request to a handler that reads multipart data and bypass client_max_size. This issue is fixed in version 3.14.4.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794601819198,"publishedAt":1794601819198,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-24c4-3p7v-29cm"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aio-libs/aiohttp/pull/13509"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aio-libs/aiohttp/pull/13513"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aio-libs/aiohttp/commit/2d9c5c1062eff0034fb3ab120897a6c1b3ff7041"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"remediation":[],"revision":"1483aaa6c02d8c485107ba504eae8df540d2ae8788d6a3ae4ca05bbfe32c2270","sources":[{"modifiedAt":1794601819198,"name":"CNA: GitHub_M","retrievedAt":1794604209019,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128127"}],"ssvc":null,"status":"published","title":"AIOHTTP: Base64 multipart parts bypass client_max_size","updatedAt":1794604209019}