CVE-2024-52303 — Aiohttp vulnerability

Vendor	Product	Version range	Fixed in
aio-libs	aiohttp	—	—
aiohttp	aiohttp	>= 3.10.6 < 3.10.11	3.10.11
aiohttp	aiohttp	>= 3.10.6 < 3.10.11	3.10.11
debian	python-aiohttp	< python-aiohttp 3.10.11-1 (forky)	python-aiohttp 3.10.11-1 (forky)

GHSA

aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

ghsa·2024-11-18

CVE-2024-52303 [MEDIUM] CWE-772 aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method ### Summary A memory leak can occur when a request produces a `MatchInfoError`. This was caused by adding an entry to a cache on each request, due to the building of each `MatchInfoError` producing a unique cache entry. ### Impact If the user is making use of any middlewares with `aiohttp.web` then it is advisable to upgrade immediately. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Patch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936

OSV

aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

osv·2024-11-18

CVE-2024-52303 [MEDIUM] aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method ### Summary A memory leak can occur when a request produces a `MatchInfoError`. This was caused by adding an entry to a cache on each request, due to the building of each `MatchInfoError` producing a unique cache entry. ### Impact If the user is making use of any middlewares with `aiohttp.web` then it is advisable to upgrade immediately. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Patch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936

OSV

CVE-2024-52303: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python

osv·2024-11-18·CVSS 8.7

CVE-2024-52303 [HIGH] CVE-2024-52303: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.

Oracle

Oracle Oracle Communications Risk Matrix: Automated Test Suite (AIOHTTP) — CVE-2024-52303

vendor_oracle·2025-04-15·CVSS 7.5

CVE-2024-52303 [HIGH] Oracle Oracle Communications Risk Matrix: Automated Test Suite (AIOHTTP) — CVE-2024-52303 Oracle Oracle Communications Risk Matrix: Automated Test Suite (AIOHTTP) vulnerability CVE: CVE-2024-52303 CVSS: 7.5 Protocol: HTTP Remote exploit: Yes Affected versions: Network Advisory: cpuapr2025 (APR 2025)

Red Hat

aiohttp: aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method

vendor_redhat·2024-11-18·CVSS 8.7

CVE-2024-52303 [HIGH] CWE-772 aiohttp: aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method aiohttp: aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch. A flaw was found in the aiohttp package. A memory leak can occur in certain configurations when a request pr

Debian

CVE-2024-52303: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...

vendor_debian·2024·CVSS 8.7

CVE-2024-52303 [HIGH] CVE-2024-52303: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ... aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 3.10.11-1) sid: resolved (fixed in 3.10.11-1) trixie: resolved (fixed in 3.10.11-1)

CVE-2024-52303: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur…

Affected

CVSS provenance