CVE-2026-123817 is a vulnerability in aiohttp's WebSocket frame reassembly process where multiple small transport reads cause excessive memory usage. The reader keeps one bytes object per read without bounding the count, leading to memory consumption far exceeding the configured max_msg_size. This can be exploited by sending a frame in many tiny segments, causing excessive memory or CPU use on the server or client side.