uvicorn WSGI interface: reading request body is O(n^2) wrt

The Fix

Upgrade to version 0.17.5 or later.

Based on closed Kludex/uvicorn issue #708 · PR/commit linked

Production note: This usually shows up under retries/timeouts. Treat it as a side-effect risk until you can verify behavior with a canary + real traffic.

Jump to Verify Open PR/Commit

@@ -1,5 +1,6 @@
@@ -1,5 +1,6 @@
+import io
 import sys
-from typing import List

repro.py

def app(environ, start_response):
    status = '200 OK'  # HTTP Status
    headers = [('Content-type', 'text/plain')]  # HTTP Headers
    start_response(status, headers)

    stream = environ['wsgi.input']
    length = 0
    while True:
        chunk = stream.read(8192)
        if not chunk:
            break
        length += len(chunk)

    resp = "Payload size: {}".format(length)
    return [resp.encode()]

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\nUpgrade to version 0.17.5 or later.\nWhen NOT to use: This fix is not applicable if the application relies on the previous behavior of the WSGI middleware.\n\n

Why This Fix Works in Production

Trigger: This is related to https://github.com/encode/uvicorn/issues/371 and potentially a duplicate/complementary information, feel free to close if it is deemed to be…
Mechanism: Inefficient bytestring concatenation leads to O(n^2) time complexity when reading request bodies
Why the fix works: Fixes the WSGI middleware to prevent quadratic time complexity when handling larger request bodies. (first fixed release: 0.17.5).

Production impact:

If left unfixed, this can cause silent data inconsistencies that propagate (bad cache entries, incorrect downstream decisions).

Why This Breaks in Prod

Inefficient bytestring concatenation leads to O(n^2) time complexity when reading request bodies
Production symptom (often without a traceback): This is related to https://github.com/encode/uvicorn/issues/371 and potentially a duplicate/complementary information, feel free to close if it is deemed to be the case.

Proof / Evidence

GitHub issue: #708
Fix PR: https://github.com/kludex/uvicorn/pull/1329
First fixed release: 0.17.5
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.65

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“The issue most probably lies in bytestring concatenation: https://github.com/encode/uvicorn/blob/master/uvicorn/middleware/wsgi.py#L85 chunks.append(chunk)... b''.join(chunks), accumulating in a BytesIO, bytearray_var += ... should all work O(n).”

@vytas7 · 2020-07-01 · source

“Maybe you can try https://github.com/abersheeran/a2wsgi It works very well on our production program.”

@abersheeran · 2020-08-09 · source

Failure Signature (Search String)

This is related to https://github.com/encode/uvicorn/issues/371 and potentially a duplicate/complementary information, feel free to close if it is deemed to be the case.

Copy-friendly signature

signature.txt

Failure Signature
-----------------
This is related to https://github.com/encode/uvicorn/issues/371 and potentially a duplicate/complementary information, feel free to close if it is deemed to be the case.

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
This is related to https://github.com/encode/uvicorn/issues/371 and potentially a duplicate/complementary information, feel free to close if it is deemed to be the case.

Minimal Reproduction

repro.py

def app(environ, start_response):
    status = '200 OK'  # HTTP Status
    headers = [('Content-type', 'text/plain')]  # HTTP Headers
    start_response(status, headers)

    stream = environ['wsgi.input']
    length = 0
    while True:
        chunk = stream.read(8192)
        if not chunk:
            break
        length += len(chunk)

    resp = "Payload size: {}".format(length)
    return [resp.encode()]

What Broke

Significant delays occur when processing large payloads, impacting response times.

Why It Broke

Inefficient bytestring concatenation leads to O(n^2) time complexity when reading request bodies

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

Upgrade to version 0.17.5 or later.

When NOT to use: This fix is not applicable if the application relies on the previous behavior of the WSGI middleware.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/kludex/uvicorn/pull/1329

First fixed release: 0.17.5

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

This fix is not applicable if the application relies on the previous behavior of the WSGI middleware.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Capture the exact failing error string in logs and tests so you can reproduce via a minimal script.
Pin production dependencies and upgrade only with a reproducible test that hits the failing path.

Version Compatibility Table

Version	Status
0.17.5	Fixed

Related Issues

No related fixes found.

Cluster: uvicorn:data-consistency All hubs All clusters

Related clusters: Configuration error Race condition SSL handshake

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

uvicorn WSGI interface: reading request body is O(n^2) wrt payload size (Fix)