CVE-2026-123817 is a vulnerability in aiohttp's WebSocket frame reassembly process where multiple small transport reads cause excessive memory and CPU usage. This occurs because the reader keeps one bytes object per read without bounding the count, leading to memory use far exceeding the configured max message size. An attacker can exploit this by sending a frame fragmented into many tiny segments, causing resource exhaustion on the server or client.