CVE-2026-123817 is a high-severity vulnerability in aiohttp affecting versions >=2.19.0 and <2.19.0_2. It involves excessive memory and CPU usage when reassembling WebSocket frames delivered in many small segments. An attacker can exploit this by sending frames in numerous tiny parts, causing the server or client to consume far more memory than intended.