Memory Leak Vulnerability in aiohttp Package: CVE-2024-52303
Summary
CVE-2024-52303: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affects python-aiohttp across 2 version ranges.
< 3.10.11-1
< bc15db61615079d1b6327ba42c682f758fa96936
Fixed in 3.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp is an asynchronous HTTP client/server framework designed for asyncio and Python, enabling developers to build efficient web applications. It supports both client and server-side operations, making it versatile for various web-related tasks. However, certain versions of aiohttp are susceptible to a memory leak issue that can severely impact server performance.
Vulnerability Detail
In aiohttp versions 3.10.6 to 3.10.10, a memory leak can occur when a request results in a MatchInfoError. This issue arises because each request generates a unique cache entry, leading to excessive memory consumption. An attacker could exploit this vulnerability by sending a large volume of requests, potentially exhausting the server's memory resources and causing denial of service.
How To Fix
Minimum fixed version
3.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-aiohttpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability other than upgrading to the patched version. However, limiting the number of requests from untrusted sources can help mitigate the risk temporarily.
Conclusion
The CVE-2024-52303 vulnerability in aiohttp poses a significant risk due to its potential to exhaust server memory through repeated requests. It is crucial for users of affected versions to upgrade to version 3.10.11 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python-aiohttp →
FAQ
CVE-2024-52303 is a vulnerability in the aiohttp package that can lead to a memory leak when a request produces a MatchInfoError.
Versions of aiohttp starting from 3.10.6 up to 3.10.10 are affected by this vulnerability.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
If immediate upgrading is not possible, consider implementing rate limiting on incoming requests to reduce the risk of exploitation.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python-aiohttp.
