Answer in brief
CVE-2026-128130 records a High severity (CVSS 8.3) vulnerability in AIOHTTP: Pure-Python parser request replay and buffer growth behind a declined upgrade. The current sources do not mark it as known exploited. The current feed maps aio-libs/aiohttp (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps aio-libs/aiohttp (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| aio-libs/aiohttpgeneric | <3.14.4 | 3.14.4 |
Published upstream
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 13, 2026
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, when the pipelined request queue is full, the pure-Python parser stores the unparsed remainder internally and also returns the same data to its caller. After a handler declines an upgrade request, the caller feeds the remainder back to the parser, causing the buffer to grow with each handled request and dispatching already-handled requests to the application again. The issue affects deployments using AIOHTTP_NO_EXTENSIONS or otherwise running without the standard C-extension wheel, and can cause excessive memory use and repeated request processing. This issue is fixed in version 3.14.4.
Quoted source text, attributed separately from HOL analysis.