CVE-2026-34517: 
Wolfi vulnerability analysis and mitigation

CVE-2026-34517 is a memory Denial-of-Service vulnerability in the AIOHTTP asynchronous HTTP client/server framework for Python. Prior to version 3.13.4, aiohttp read the entire non-file multipart form field into memory before enforcing the client_max_size limit, allowing an unauthenticated attacker to force significant temporary memory allocation. All versions up to and including 3.13.3 are affected; the issue was patched in version 3.13.4. It was published on March 31, 2026, with a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 2.7 (Low) (Github Advisory, Red Hat Bugzilla).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): in the Request.post() method within aiohttp/web_request.py, non-file multipart fields were read entirely into memory via field.read(decode=True) before the accumulated size was compared against client_max_size. The fix (commit cbb774f) restructures the read loop to check the size incrementally during chunk iteration, raising HTTPRequestEntityTooLarge as soon as the limit is exceeded. Exploitation requires no authentication, no special privileges, and no user interaction — an attacker simply sends a crafted multipart HTTP POST request with oversized non-file fields to any endpoint that calls Request.post() (Github Advisory, Patch Commit).

Successful exploitation causes significant temporary memory allocation on the server, potentially exhausting available memory and degrading or crashing the aiohttp service (availability impact). There is no confidentiality or integrity impact — the vulnerability is purely a resource exhaustion issue. Applications using Request.post() to handle multipart form submissions are directly at risk, and repeated attacks could sustain a denial-of-service condition against the affected service (Github Advisory).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.02% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is rated "Unreported" in CVSS v4.0 (Github Advisory).

1. Reconnaissance: Identify internet-facing services built on aiohttp versions ≤ 3.13.3 that expose endpoints accepting multipart form submissions (e.g., file upload or form processing endpoints).
2. Craft malicious request: Construct an HTTP POST request with Content-Type: multipart/form-data containing one or more non-file form fields with very large payloads (e.g., a text field with megabytes or gigabytes of data).
3. Send request: Transmit the crafted request to the target endpoint that invokes Request.post(). The server will read the entire field into memory before checking client_max_size.
4. Trigger memory exhaustion: Repeat the request rapidly or with multiple concurrent connections to amplify memory pressure, potentially causing the server process to slow significantly or crash due to memory exhaustion (Github Advisory, Patch Commit).

• Network: High volume of HTTP POST requests to multipart form endpoints from one or more source IPs; requests with unusually large Content-Length headers targeting form submission endpoints.
• Logs: Server access logs showing repeated large multipart POST requests; application logs showing HTTPRequestEntityTooLarge errors (on patched systems) or memory allocation errors/OOM kills (on unpatched systems).
• Process: Sudden spike in memory consumption by the aiohttp server process; process restarts or OOM-killer events in system logs (/var/log/syslog, dmesg) attributable to the Python aiohttp worker.

Upgrade aiohttp to version 3.13.4 or later, which enforces client_max_size incrementally during multipart field chunk iteration rather than after the full field is read into memory. No configuration-based workaround is available for unpatched versions; the only effective mitigation is upgrading. Downstream IBM products (Process Mining, API Connect, watsonx Code Assistant On Prem, Instana Observability) have also released interim fixes incorporating this patch (Github Advisory, aiohttp v3.13.4 Release, IBM Process Mining Fix).

The vulnerability was reported by researcher "bekkaze" and remediated by maintainer Dreamsorcerer, who published the advisory on March 31, 2026. Red Hat tracked the issue via Bugzilla (Bug 2454095) and rated it low severity. IBM issued security bulletins for multiple affected products including Process Mining, API Connect, watsonx Code Assistant On Prem, and Instana Observability. Debian also issued an LTS security announcement covering this CVE (Red Hat Bugzilla, IBM Process Mining Fix).