CVE-2026-123817 is a high-severity vulnerability in aiohttp versions 1.5.3 up to but not including 1.6.2. It involves excessive memory and CPU usage caused by the WebSocket frame reader retaining many small bytes objects without bounds when frames arrive in many small segments. This can lead to memory consumption far exceeding the configured max message size.