Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨High - aiohttp DoS via multipart/form-data Infinite Loop (CVE-2024-30251) aiohttp's multipart/form-data POST parser can be driven into an infinite loop by a specially crafted malformed multipart request, consuming the event loop and preventing the server from handling further requests after a single hit. Non-multipart handlers aren’t affected. 👉Affected: aiohttp < 3.9.4 | Upgrade to 3.9.4
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | aiohttp | aiohttp | - | - | - |