aiohttp EUVD-2026-38314

aiohttp is an asynchronous HTTP client/server framework for Python, distributed as pip package pkg:pip/aiohttp. Pre-built PyPI wheels ship an optimised C HTTP parser implemented in Cython (aiohttp/_http_parser.pyx), backed by llhttp - the same HTTP parser used by Node.js. The parser enforces a max_line_size limit (default 8190 bytes) via two llhttp callbacks: cb_on_url (for HTTP request targets) and cb_on_status (for HTTP response reason phrases). The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): each callback invocation checked only the current fragment's byte count (if length > max_line_size) rather than the total accumulated buffer length (if len(buf) + length > max_line_size). Because TCP is a stream protocol, data for a single logical HTTP line can arrive across multiple read() calls, each invoking the callback independently. An attacker can deliberately fragment an overlong URL or reason phrase so that no individual fragment exceeds the limit, while the accumulated buffer grows without bound. The one-line fix per callback - adding len(pyparser._buf) to the comparison - brings the C parser into alignment with the pure-Python implementation that was already correct.