GitHub Advisoryadvisory · PyPI

GHSA-27mf-ghqm-j3j8 aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

MEDIUM Published 2024-11-18 Modified 2024-11-19 Official page ↗
Aliases
CVE-2024-52303
Ecosystem
PyPI
Packages
aiohttp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-772
Reviewed
2024-11-18

Affected packages

• PyPI aiohttp: >= 3.10.6, < 3.10.11 → fixed in 3.10.11

Description

Summary A memory leak can occur when a request produces a `MatchInfoError`. This was caused by adding an entry to a cache on each request, due to the building of each `MatchInfoError` producing a unique cache entry. Impact If the user is making use of any middlewares with `aiohttp.web` then it is advisable to upgrade immediately. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. ----- Patch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936

Related

Alias · CVE (1)

  • CVE-2024-52303 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. vulnerability

Weakness · CWE (1)

  • CWE-772 Missing Release of Resource after Effective Lifetime weakness

References