CVE-2026-123817 is a vulnerability in aiohttp's WebSocket frame reassembly process where multiple small transport reads cause excessive memory and CPU usage. The reader keeps one bytes object per read without bounding the count, leading to memory use far exceeding the configured max_msg_size. This can be exploited by sending a frame in many tiny segments to cause resource exhaustion on servers or clients.