PT-2024-3818 · Aiohttp+4 · Aiohttp+4
Bytehope
·
Published
2024-05-02
·
Updated
2026-02-18
·
CVE-2024-30251
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
aiohttp versions prior to 3.9.4
Description
The issue is related to an infinite loop that occurs when the aiohttp server processes a specially crafted POST (multipart/form-data) request. This allows an attacker to stop the application from serving requests after sending a single request, resulting in a denial of service. The attacker can send a malicious request to the server, causing it to enter an infinite loop and become unable to process further requests.
Recommendations
For versions prior to 3.9.4, upgrade to version 3.9.4 or later to resolve the issue.
As a temporary workaround, users unable to upgrade can manually apply a patch to their systems by modifying the
read chunk from length() function in aiohttp/multipart.py to include the necessary checks for the end of the file.
Restrict access to the vulnerable multipart.py module to minimize the risk of exploitation until a patch is applied.
Avoid using the multipart/form-data request type in the affected API endpoint until the issue is resolved.Exploit
Fix
DoS
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Red Os
Suse
Ubuntu
Aiohttp