CVE-2026-123817 is a vulnerability in aiohttp's WebSocket frame reassembly process where multiple small transport reads cause excessive memory and CPU usage. This occurs because the reader keeps one bytes object per read without bounding the count, leading to high overhead memory consumption when frames are delivered in many tiny segments. An attacker can exploit this to cause resource exhaustion on a WebSocket server or client.