AIOHTTP contains an out-of-bounds heap read in the C response parser that can be triggered when the client builds an error message for a malformed HTTP response. The flaw allows an attacker-controlled server or malformed payloads to cause the client library to read beyond valid memory, which in turn can crash the application and result in a denial of service. The weakness is represented by CWE-125, CWE-400 and CWE-416, indicating memory corruption, resource exhaustion, and use-after-free issues.

The vulnerability affects the aio-libs/aiohttp Python package, version 3.14.2 and earlier. Any environment that uses these releases in client mode is susceptible, regardless of the server type, as the fault occurs in the client’s response parsing logic.

The CVSS score of 7.1 indicates a high severity and the attacher can exploit the weakness by delivering a malformed chunked response or an incorrect request or response byte sequence to the aiohttp client. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, but the lack of a known exploit does not reduce the risk of a future targeted attack. The impact is limited to the stability of the application using the library; no direct information disclosure or remote code execution is reported.