aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method
### Summary A memory leak can occur when a request produces a `MatchInfoError`. This was caused by adding an entry to a cache on each request, due to the building of each `MatchInfoError` producing a unique cache entry. ### Impact If the user is making use of any middlewares with `aiohttp.web` then it is advisable to upgrade immediately. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. ----- Patch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-52303US | — | — | ||
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produc… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/advisories/GHSA-27mf-ghqm-j3j8ADVISORY
- https://github.com/aio-libs/aiohttpPACKAGE
- https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936FIX
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-27mf-ghqm-j3j8WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-52303ADVISORY
- https://pypi.org/project/aiohttpPACKAGE
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan