CVE-2026-70646: aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate() deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiosendto a version that resolves this vulnerability.Fixed in 3.0.7 - Compensating control
At the reverse proxy or web framework, restrict request body size and/or reject oversized requests before JSON parsing for webhook endpoints.
- Compensating control
Rate-limit webhook endpoints to mitigate pre-auth DoS attempts that force expensive JSON parsing prior to HMAC verification.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70646?
The severity of CVE-2026-70646 is high, rated at 7.5.
What type of vulnerability is CVE-2026-70646?
CVE-2026-70646 is a deserialization vulnerability that can result in a pre-authentication denial of service (DoS) in the webhook handler.
How do I fix CVE-2026-70646?
To fix CVE-2026-70646, upgrade to aiosend version 3.0.7 or later, where the issue has been addressed.
What is the impact of CVE-2026-70646?
The impact of CVE-2026-70646 is that it allows unauthenticated attackers to force expensive parsing of arbitrary JSON payloads.
Which software is affected by CVE-2026-70646?
CVE-2026-70646 affects the aiosend software prior to version 3.0.7.