The flaw allows an attacker to send large, incomplete WebSocket frames that bypass the framework’s configured memory size checks. The result is that the server can consume more memory than intended, potentially exhausting available resources and degrading or halting service availability. The weakness is a classic resource exhaustion issue (CWE-770).

The affected product is the aio-libs AIOHTTP framework, versions earlier than 3.14.1. Systems running any of those versions are susceptible, regardless of platform or deployment environment.

The CVSS score of 6.6 reflects a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating low documented exploitation. Attackers would need remote access via a WebSocket connection to the vulnerable service. If exploited, a single attacker could consume a significant fraction of the host’s memory, leading to service interruption. The lack of an exploited reference suggests the attack path is not widely used yet, but the risk remains due to the potential for denial of service.