Infinite Loop Vulnerability in aiohttp Package - CVE-2024-30251
Summary
CVE-2024-30251: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affects python-aiohttp across 4 version ranges.
< 3.7.4-1+deb11u1
< 7eecdff163ccf029fbb1ddc9de4169d4aaeb6597
< cebe526b9c34dc3a3da9140409db63014bc4cf19
< f21c6f2ca512a026ce7f0f6c6311f62d6a638866
Fixed in 3.7.4-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp is an asynchronous HTTP client/server framework designed for asyncio and Python, enabling developers to build efficient web applications. It supports both client and server-side functionalities, making it a versatile choice for handling HTTP requests. However, certain versions of aiohttp are susceptible to a critical vulnerability that can disrupt server operations.
Vulnerability Detail
The vulnerability identified as CVE-2024-30251 allows an attacker to send a specially crafted POST request with multipart/form-data. When the aiohttp server processes this request, it enters an infinite loop, rendering it incapable of handling any further requests. This can lead to denial of service, as the server becomes unresponsive after a single malicious request. The issue affects multiple versions of the aiohttp package and has been addressed in version 3.9.4 and later.
How To Fix
Minimum fixed version
3.7.4-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-aiohttpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users unable to upgrade immediately, a manual patch can be applied to mitigate the vulnerability. Specific instructions for applying the patch can be found in the linked GitHub Security Advisory (GHSA-5m98-qgg9-wh84). It is recommended to review the advisory for detailed steps.
Conclusion
The CVE-2024-30251 vulnerability in the aiohttp package poses a significant risk by allowing denial of service through crafted requests. Users are strongly encouraged to upgrade to version 3.9.4 or later to protect their applications. For those unable to upgrade immediately, a manual patch is available as a temporary measure.
See every vulnerability recorded for python-aiohttp →
FAQ
CVE-2024-30251 is a vulnerability in the aiohttp package that allows an attacker to send a malicious POST request, causing the server to enter an infinite loop.
All versions of aiohttp prior to 3.9.4 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary consequence is denial of service, as the aiohttp server becomes unresponsive after processing a malicious request.
Yes, users can apply a manual patch as described in the GitHub Security Advisory linked in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for python-aiohttp.
