### Summary
While reassembling a WebSocket frame that arrived across many small transport reads, the reader kept one `bytes` object per read with no bound on the count. The per-object overhead is many times larger than the payload bytes, so a frame delivered a few bytes at a time could use far more memory than `max_msg_size` allows.
### Impact
An attacker could cause excessive memory use in a WebSocket server, or a malicious server against a client, by sending a frame in a large number of tiny segments.