GHSA-27mf-ghqm-j3j8MediumCVSS 7.5

aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

Published
November 18, 2024
Last Modified
November 19, 2024

🔗 CVE IDs covered (1)

CVE-2024-52303 →

📋 Description

Summary

A memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry.

Impact

If the user is making use of any middlewares with aiohttp.web then it is advisable to upgrade immediately.

An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests.

Patch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936

🎯 Affected products1

  • pip/aiohttp:>= 3.10.6, < 3.10.11

🔗 References (4)