The Fix
Updates the Brotli decompressor to ensure compatibility with the new Brotli version by adjusting the maximum output size parameter.
Based on closed aio-libs/aiohttp issue #11939 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -0,0 +1,2 @@
@@ -0,0 +1,2 @@
+``Brotli`` and ``brotlicffi`` minimum version is now 1.2.
+Decompression now has a default maximum output size of 32MiB per decompress call -- by :user:`Dreamsorcerer`.
diff --git a/aiohttp/compression_utils.py b/aiohttp/compression_utils.py
% mamba list | fgrep -i -e aiohttp -e brotli -e python
aiohttp 3.13.3 py312h9f8c436_0 conda-forge
brotli 1.1.0 h6caf38d_4 conda-forge
brotli-bin 1.1.0 h6caf38d_4 conda-forge
brotli-python 1.1.0 py312h6b01ec3_4 conda-forge
libbrotlicommon 1.1.0 h6caf38d_4 conda-forge
libbrotlidec 1.1.0 h6caf38d_4 conda-forge
libbrotlienc 1.1.0 h6caf38d_4 conda-forge
python 3.12.12 h18782d2_1_cpython conda-forge
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Option A — Apply the official fix\nUpdates the Brotli decompressor to ensure compatibility with the new Brotli version by adjusting the maximum output size parameter.\nWhen NOT to use: Do not use this fix if you rely on the previous behavior of the decompressor.\n\n
Why This Fix Works in Production
- Trigger: chunk = self.decompressor.decompress_sync(
- Mechanism: Aiohttp's decompressor incorrectly calls Brotli's process method with two arguments instead of one
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Shows up under Python 3.12 in real deployments (not just unit tests).
- Aiohttp's decompressor incorrectly calls Brotli's process method with two arguments instead of one
- Surfaces as: Traceback (most recent call last):
Proof / Evidence
- GitHub issue: #11939
- Fix PR: https://github.com/aio-libs/aiohttp/pull/11898
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.80
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.42
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“As per the changelog (and the speedups dependency pins), the minimum supported version is now 1.2. This is needed to resolve a security issue, hence…”
“Ahh this was just a versioning issue. Sorry for the noise.”
Failure Signature (Search String)
- chunk = self.decompressor.decompress_sync(
Error Message
Stack trace
Error Message
-------------
Traceback (most recent call last):
File "/opt/homebrew/Cellar/micromamba/2.1.0/envs/standard/lib/python3.12/site-packages/aiohttp/http_parser.py", line 1030, in feed_data
chunk = self.decompressor.decompress_sync(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/Cellar/micromamba/2.1.0/envs/standard/lib/python3.12/site-packages/aiohttp/compression_utils.py", line 312, in decompress_sync
return cast(bytes, self._obj.process(data, max_length))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: process() takes exactly 1 argument (2 given)
Minimal Reproduction
% mamba list | fgrep -i -e aiohttp -e brotli -e python
aiohttp 3.13.3 py312h9f8c436_0 conda-forge
brotli 1.1.0 h6caf38d_4 conda-forge
brotli-bin 1.1.0 h6caf38d_4 conda-forge
brotli-python 1.1.0 py312h6b01ec3_4 conda-forge
libbrotlicommon 1.1.0 h6caf38d_4 conda-forge
libbrotlidec 1.1.0 h6caf38d_4 conda-forge
libbrotlienc 1.1.0 h6caf38d_4 conda-forge
python 3.12.12 h18782d2_1_cpython conda-forge
Environment
- Python: 3.12
What Broke
Application fails to decompress responses, leading to download failures for over 100,000 files.
Why It Broke
Aiohttp's decompressor incorrectly calls Brotli's process method with two arguments instead of one
Fix Options (Details)
Option A — Apply the official fix
Updates the Brotli decompressor to ensure compatibility with the new Brotli version by adjusting the maximum output size parameter.
Fix reference: https://github.com/aio-libs/aiohttp/pull/11898
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- Do not use this fix if you rely on the previous behavior of the decompressor.
Verify Fix
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Capture the exact failing error string in logs and tests so you can reproduce via a minimal script.
- Pin production dependencies and upgrade only with a reproducible test that hits the failing path.
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.