AIOHTTP reads entire multipart form data fields into memory before validating them against the configured client_max_size limit. This behavior enables an attacker to submit overly large fields that consume excessive server memory, causing performance degradation or a crash and resulting in a denial of service for legitimate users. The impact is a resource exhaustion vulnerability classified under CWE‑770 with a CVSS score of 2.7.

The vulnerable component is the aio-libs aiohttp framework. All installations of aiohttp prior to version 3.13.4 are affected. Applications that expose HTTP endpoints using this library, whether as a web framework or as an HTTP client handling multipart data, are at risk.

Based on the description, it is inferred that an attacker can remotely send specially crafted HTTP requests to a server that uses a vulnerable aiohttp instance. The low CVSS score and the absence of an EPSS metric suggest a moderate overall risk, but the lack of a current Public Exploit Means the threat is likely limited to environments where the server accepts multipart form data. The vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale exploitation. Nevertheless, when a single client can exhaust server memory, the denial of service impact can be significant for critical services.