CVE-2026-128130: aiohttp: pure-Python parser buffer growth causes DoS

Q: Is CVE-2026-128130 actively exploited?

No confirmed active exploitation of CVE-2026-128130 has been reported, but organizations should still patch proactively.

Q: What systems are affected by CVE-2026-128130?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, LLM API gateways, MCP servers, async inference backends.

Q: What is the CVSS score for CVE-2026-128130?

No CVSS score has been assigned yet.

HIGH

Published November 13, 2026

CISO Take

aiohttp, the widely used asyncio HTTP client/server library, has a flaw in its pure-Python request parser. When the pipelined request queue is full, the parser keeps the unparsed remainder and also hands it back to the caller. The caller then re-feeds it after a handler declines an upgrade, so memory grows with each request and already-handled requests are dispatched to the application again. Exposure is limited to deployments running without the standard C-extension wheel, for example those that set AIOHTTP_NO_EXTENSIONS or run on platforms with no prebuilt wheel. There is no CISA KEV listing, no public exploit and no Nuclei template, and no EPSS score or CVSS vector has been published yet, so near-term exploitation looks unlikely. The practical risk is availability: repeated processing of requests can exhaust memory or trigger duplicate actions in AI agent backends and model-serving APIs built on aiohttp. Upgrade to aiohttp 3.14.4 or later, and check whether any services run the pure-Python parser.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium-high for affected deployments, low overall. Severity is rated high, but no CVSS vector or EPSS score is available. There is no known public exploit, no KEV listing and no scanner template. Exploitation needs a network-reachable aiohttp server running the pure-Python parser, which means AIOHTTP_NO_EXTENSIONS is set or the C-extension wheel is missing. The attacker needs no privileges. Impact is resource exhaustion (CWE-770) and repeated request processing in a loop (CWE-835). Most production installs use the C-extension parser and are not exposed. Package risk data is limited, and the dependent count is unknown even though aiohttp is a very common transitive dependency in the AI stack.

How does the attack unfold?

Initial Access

The attacker connects to an internet-facing aiohttp service that runs the pure-Python parser.

AML.T0049

Exploitation

The attacker sends pipelined requests and upgrade requests that the handler declines, so the parser's queue fills and the leftover buffer is stored and re-fed.

AML.T0049

Impact

Memory grows without bound and already-handled requests are dispatched again, which crashes the service and causes duplicate agent or LLM actions.

AML.T0029

Initial Access

The attacker connects to an internet-facing aiohttp service that runs the pure-Python parser.

AML.T0049

Exploitation

The attacker sends pipelined requests and upgrade requests that the handler declines, so the parser's queue fills and the leftover buffer is stored and re-fed.

AML.T0049

Impact

Memory grows without bound and already-handled requests are dispatched again, which crashes the service and causes duplicate agent or LLM actions.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
aiohttp	—	—	No patch

Do you use aiohttp? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade aiohttp to 3.14.4 or later (fixes in PRs 13356 and 13360). 2) Inventory services for AIOHTTP_NO_EXTENSIONS=1 or installs lacking the C-extension wheel (for example some musl, ARM or custom builds), and switch to the standard wheel where possible. 3) Put a reverse proxy in front of aiohttp services to limit pipelining, request rate and connection memory. 4) Set container memory limits and alerts on RSS growth, so a leak triggers a restart instead of a host-wide outage. 5) Make handlers idempotent for agent and tool endpoints. 6) Detect with SCA tooling that flags aiohttp < 3.14.4 and with monitoring for duplicate request IDs in application logs.

How is it classified?

DoSFrameworkAPIAgentAML.T0029- Denial of AI Service AML.T0034.000- Excessive Queries AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-128130?

Is CVE-2026-128130 actively exploited?

No confirmed active exploitation of CVE-2026-128130 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-128130?

1) Upgrade aiohttp to 3.14.4 or later (fixes in PRs 13356 and 13360). 2) Inventory services for AIOHTTP_NO_EXTENSIONS=1 or installs lacking the C-extension wheel (for example some musl, ARM or custom builds), and switch to the standard wheel where possible. 3) Put a reverse proxy in front of aiohttp services to limit pipelining, request rate and connection memory. 4) Set container memory limits and alerts on RSS growth, so a leak triggers a restart instead of a host-wide outage. 5) Make handlers idempotent for agent and tool endpoints. 6) Detect with SCA tooling that flags aiohttp < 3.14.4 and with monitoring for duplicate request IDs in application logs.

What systems are affected by CVE-2026-128130?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, LLM API gateways, MCP servers, async inference backends.

What is the CVSS score for CVE-2026-128130?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel servingLLM API gatewaysMCP serversasync inference backends

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0034.000Excessive Queries

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, when the pipelined request queue is full, the pure-Python parser stores the unparsed remainder internally and also returns the same data to its caller. After a handler declines an upgrade request, the caller feeds the remainder back to the parser, causing the buffer to grow with each handled request and dispatching already-handled requests to the application again. The issue affects deployments using AIOHTTP_NO_EXTENSIONS or otherwise running without the standard C-extension wheel, and can cause excessive memory use and repeated request processing. This issue is fixed in version 3.14.4.

Exploitation Scenario

An attacker finds an internet-facing AI agent API or inference gateway built on aiohttp that runs the pure-Python parser. They send many pipelined requests on one connection, including upgrade requests that the handler declines, so the parser's pipelined queue fills. The leftover buffer is stored and returned again, so it grows with every handled request and earlier requests are replayed to the application. The service's memory climbs until it is OOM-killed, while replayed requests trigger duplicate LLM calls or tool executions. The result is a denial of service plus unexpected inference costs.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or Throttling CWE-835Loop with Unreachable Exit Condition

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.