high7.5
CVE-2024-52303
aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method
Impact
### Summary A memory leak can occur when a request produces a `MatchInfoError`. This was caused by adding an entry to a cache on each request, due to the building of each `MatchInfoError` producing a unique cache entry. ### Impact If the user is making use of any middlewares with `aiohttp.web` then it is advisable to upgrade immediately. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. ----- Patch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | aiohttp | >= 3.10.6, < 3.10.11 | 3.10.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Aiohttp | Aiohttp | from 3.10.6 before 3.10.11 |