CVE-2026-123817 is a vulnerability in aiohttp's WebSocket frame reassembly process where the reader accumulates many small bytes objects without bounding their count. This leads to excessive memory consumption when frames are delivered in numerous tiny segments. An attacker can exploit this to cause high memory usage on a WebSocket server or client. The issue affects vdirsyncer versions from 0.19.0 up to but not including 0.21.0_2. A fix is available in version 0.21.0_2.