CVE-2026-34516: 
Wolfi vulnerability analysis and mitigation

CVE-2026-34516 is a Denial-of-Service vulnerability in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, caused by a multipart header size bypass. Prior to version 3.13.4, responses containing an excessive number of multipart headers were not subject to the same size restrictions applied to normal headers, allowing unbounded memory consumption. All versions up to and including 3.13.3 are affected; version 3.13.4 contains the fix. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.6 (Medium) (Github Advisory, aiohttp Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the MultipartReader class in aiohttp/multipart.py did not enforce max_field_size or max_headers limits when parsing multipart body part headers, unlike the restrictions applied to standard HTTP headers. An attacker (or a malicious server in a client context) could craft a multipart response or request containing an arbitrarily large number of headers or oversized header lines, causing the application to load substantially more data into memory than intended. The fix (commit 8a74257) introduces max_field_size (default 8190 bytes) and max_headers (default 128) parameters to MultipartReader, propagates these limits through readline() and readuntil() calls, and raises BadHttpMessage or LineTooLong exceptions when limits are exceeded (aiohttp Advisory, Patch Commit).

Successful exploitation results in excessive memory consumption by the affected aiohttp process, potentially leading to application crashes, service unavailability, or system-wide performance degradation — a classic Denial-of-Service outcome. There is no impact on confidentiality or data integrity; the vulnerability is limited to availability. The advisory notes that other existing restrictions partially limit the severity of the impact, which is reflected in the moderate/medium CVSS v4 rating (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.02% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The exploit maturity is rated "Unreported" in CVSS v4 scoring (Github Advisory).

1. Identify target: Locate a service running aiohttp version ≤ 3.13.3 that processes multipart requests (e.g., file upload endpoints using request.multipart() or request.post()).
2. Craft malicious multipart request: Construct an HTTP POST request with Content-Type: multipart/form-data; boundary=<boundary> containing a body part that includes an excessive number of headers (e.g., more than 128 custom headers such as X-0: a, X-1: a, ...) or individual headers exceeding 8190 bytes in length.
3. Send the request: Transmit the crafted request to the target endpoint. Because no authentication or special privileges are required, this can be done by any unauthenticated network attacker.
4. Trigger memory exhaustion: The unpatched MultipartReader reads all provided headers without enforcing size or count limits, causing the server process to allocate memory proportional to the attacker-controlled input, potentially exhausting available memory and causing a DoS condition (aiohttp Advisory, Patch Commit).

• Network: Repeated HTTP POST requests to multipart-processing endpoints with unusually large Content-Type: multipart/form-data bodies; requests containing abnormally high numbers of MIME part headers or oversized individual header lines.
• Logs: aiohttp access logs showing POST requests to file upload or form processing endpoints with large content lengths from the same or rotating source IPs; application error logs showing MemoryError or out-of-memory conditions in the aiohttp process.
• Process/System: Sudden spike in memory usage by the Python/aiohttp worker process(es); OOM-killer events in system logs (dmesg or /var/log/syslog) referencing the aiohttp process; service restarts or crashes correlated with inbound multipart requests.

The primary remediation is to upgrade aiohttp to version 3.13.4 or later, which enforces a default limit of 128 multipart headers and 8190 bytes per header line (aiohttp Release). IBM has also released patches for affected products including IBM Process Mining, IBM API Connect, IBM Guardium Data Security Center, IBM watsonx Code Assistant On Prem, and IBM Observability with Instana (IBM Process Mining Fix). As a network-level workaround prior to patching, consider deploying a reverse proxy or WAF rule to reject multipart requests with an excessive number of MIME headers or abnormally large body sizes. Monitoring for unusual memory consumption patterns in aiohttp processes can help detect exploitation attempts.

The vulnerability was reported by researcher "bekkaze" and remediated by maintainer "Dreamsorcerer" of the aio-libs project. Red Hat tracked the issue via Bugzilla with medium priority and severity, and multiple downstream vendors including IBM issued security advisories addressing the vulnerability in their products. The advisory was rated "Low" severity by the aiohttp project itself, noting that other existing restrictions partially mitigate the impact (aiohttp Advisory, Red Hat Bugzilla).