aio-libs/aiohttp · Security
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
- GHSA ID
- GHSA-2g87-pp6c-29x5
- Severity
- high
- Published
- Updated
- CVSS v4
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
Summary
Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests.
Impact
An attacker could cause resource exhaustion through specially crafted requests.
CWEs
- CWE-770 · Allocation of Resources Without Limits or Throttling
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2g87-pp6c-29x5 ↗
- https://github.com/aio-libs/aiohttp/commit/09bcaa73ff084a0c539bbf16a0a78743acb7141f ↗
- https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6 ↗
- https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df ↗
- https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7 ↗
- https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53 ↗
- https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa ↗
- https://github.com/aio-libs/aiohttp/commit/6a4f6682817839313b04b8e5cea2b39c1a88ab4f ↗
- https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab ↗
- https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd ↗
- https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43 ↗
- https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db ↗
- https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4 ↗
- https://github.com/advisories/GHSA-2g87-pp6c-29x5 ↗