CVE-2024-30251
published 2024-05-02CVE-2024-30251: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.09%
61.8th percentile
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.9.4 | 3.9.4 |
| aiohttp | aiohttp | < 3.9.4 | 3.9.4 |
| aiohttp | aiohttp | >= 0 < 3.9.4 | 3.9.4 |
| debian | python-aiohttp | < python-aiohttp 3.8.4-1+deb12u1 (bookworm) | python-aiohttp 3.8.4-1+deb12u1 (bookworm) |
| msrc | azl3_mozjs_102.15.1-1_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
AIOHTTP vulnerabilities
vendor_ubuntu·2025-07-17·CVSS 5.3
CVE-2023-49082 [MEDIUM] AIOHTTP vulnerabilities
Title: AIOHTTP vulnerabilities
Summary: Several security issues were fixed in AIOHTTP.
Ben Kallus discovered that AIOHTTP did not correctly parse HTTP
headers. A remote attacker could possibly use this issue to perform
request smuggling. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-47627)
Ivan Novikov discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)
Paul J. Dorn discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 20.04 LTS, Ubunt
Oracle
Oracle Oracle Communications Risk Matrix: Probe (AIOHTTP) — CVE-2024-30251
vendor_oracle·2024-10-15·CVSS 7.5
CVE-2024-30251 [HIGH] Oracle Oracle Communications Risk Matrix: Probe (AIOHTTP) — CVE-2024-30251
Oracle Oracle Communications Risk Matrix: Probe (AIOHTTP) vulnerability
CVE: CVE-2024-30251
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Microsoft
Denial of service when trying to parse malformed POST requests in aiohttp
vendor_msrc·2024-05-14·CVSS 7.5
CVE-2024-30251 [HIGH] CWE-835 Denial of service when trying to parse malformed POST requests in aiohttp
Denial of service when trying to parse malformed POST requests in aiohttp
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Red Hat
aiohttp: DoS when trying to parse malformed POST requests
vendor_redhat·2024-05-02·CVSS 7.5
CVE-2024-30251 [HIGH] CWE-835 aiohttp: DoS when trying to parse malformed POST requests
aiohttp: DoS when trying to parse malformed POST requests
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
An infinite loop flaw was found in aiohttp when handling POST (multipart/form-data) requests. This flaw allows an attacker to send a specially crafted requ
Debian
CVE-2024-30251: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...
vendor_debian·2024·CVSS 7.5
CVE-2024-30251 [HIGH] CVE-2024-30251: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
Scope: local
bookworm: resolved (fixed in 3.8.4-1+deb12u1)
bullseye: resolved (fixed in 3.7.4-1+deb11u1)
forky: resolved (fixed in 3.9.5-1)
sid: resolved (fixed in 3.9.5-1)
trixie: resolved (fixed in 3.9.5-1)
OSV
python-aiohttp vulnerabilities
osv·2025-07-17·CVSS 7.5
CVE-2023-47627 [HIGH] python-aiohttp vulnerabilities
python-aiohttp vulnerabilities
Ben Kallus discovered that AIOHTTP did not correctly parse HTTP
headers. A remote attacker could possibly use this issue to perform
request smuggling. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-47627)
Ivan Novikov discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)
Paul J. Dorn discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2024-23829)
Takes
OSV
aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
osv·2024-05-03
CVE-2024-30251 [HIGH] aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
### Summary
An attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests.
### Impact
An attacker can stop the application from serving requests after sending a single request.
For anyone needing to patch older versions of aiohttp, the minimum diff needed to resolve the issue is (located in `_read_chunk_from_length()`):
```diff
diff --git a/aiohttp/multipart.py b/aiohttp/multipart.py
index 227be605c..71fc2654a 100644
--- a/aiohttp/multipart.py
+++ b/aiohttp/multipart.py
@@ -338,6 +338,8 @@ class BodyPartReader:
assert self._length is not None, "Content-Length requir
GHSA
aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
ghsa·2024-05-03
CVE-2024-30251 [HIGH] CWE-835 aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
### Summary
An attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests.
### Impact
An attacker can stop the application from serving requests after sending a single request.
For anyone needing to patch older versions of aiohttp, the minimum diff needed to resolve the issue is (located in `_read_chunk_from_length()`):
```diff
diff --git a/aiohttp/multipart.py b/aiohttp/multipart.py
index 227be605c..71fc2654a 100644
--- a/aiohttp/multipart.py
+++ b/aiohttp/multipart.py
@@ -338,6 +338,8 @@ class BodyPartReader:
assert self._length is not None, "Content-Length requir
OSV
CVE-2024-30251: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
osv·2024-05-02·CVSS 7.5
CVE-2024-30251 [HIGH] CVE-2024-30251: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2024/05/02/4https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84http://www.openwall.com/lists/oss-security/2024/05/02/4https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html
2024-05-02
Published