CVE-2026-123817 is a high-severity vulnerability in aiohttp affecting versions 2.9.0 and later. It involves excessive memory and CPU consumption when reassembling WebSocket frames delivered in many small segments. An attacker can exploit this by sending a frame fragmented into numerous tiny parts, causing the server or client to use far more memory than intended.