CVE-2026-123817 is a vulnerability in aiohttp's WebSocket frame reassembly process where multiple small transport reads cause excessive memory use. The reader keeps one bytes object per read without bounding the count, leading to memory consumption far exceeding the configured max message size. This can be exploited by an attacker sending a frame in many tiny segments to cause excessive memory or CPU use on the server or client side.