CVE-2026-123817 is a high-severity vulnerability in aiohttp WebSocket handling where reassembling frames from many small transport reads causes excessive memory and CPU usage. This occurs because the reader keeps one bytes object per read without bounding the count, leading to memory use far beyond the configured max message size. An attacker can exploit this by sending frames segmented into many tiny pieces, causing resource exhaustion on the server or client side. The issue affects aiohttp versions from 0.26.0 up to but not including 0.34.0. A fix is available in version 0.34.0.