CVE-2026-123817 is a high-severity vulnerability in aiohttp affecting versions from 19.10b0_3 up to but not including 26.10.1. It involves excessive memory and CPU usage caused by unbounded accumulation of small WebSocket frame segments during reassembly. An attacker can exploit this by sending frames in many tiny segments, leading to resource exhaustion on servers or clients. The issue is fixed in version 26.10.1.