CVE-2022-33124: Medium severity aiohttp vulnerability

Published Jun 22, 2022

Updated

DISPUTED AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, and many common contexts have exception handing in the calling application.

Affected Software

2 affected components

aiohttp aiohttp=3.8.1

Aiohttp Project Aiohttp=3.8.1

Event History

Jun 22, 2022

CVE Published

via MITRE·07:44 PM

Data Sourced

via MITRE·07:44 PM

Description

Jun 23, 2022

Disputed

05:15 PM

Frequently Asked Questions

What is CVE-2022-33124?

CVE-2022-33124 is a vulnerability in AIOHTTP 3.8.1 that can lead to a Denial of Service (DoS) attack.

What is the severity of CVE-2022-33124?

The severity of CVE-2022-33124 is medium with a CVSS score of 5.5.

How can CVE-2022-33124 be exploited?

CVE-2022-33124 can be exploited by triggering a "ValueError: Invalid IPv6 URL" outcome in AIOHTTP 3.8.1.

How can I protect myself from CVE-2022-33124?

To protect yourself from CVE-2022-33124, consider updating AIOHTTP to a version that is not affected by this vulnerability.

Is CVE-2022-33124 a verified vulnerability?

CVE-2022-33124 is disputed by multiple third parties due to the lack of evidence of a real Denial of Service (DoS) scenario.