CVE-2024-52303CWE-772

aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method

High · published November 18, 2024

CVSS v4.0
8.7
EPSS
1%
Percentile
47.6
In the wild
Unconfirmed
What it is

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00591 · 47.6th percentile
Weakness
CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2024-11-18T20:08Z
EPSS history
Timeline
  • 18 NOV 20:08Z
    aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
    cvelistv5