GHSA-9xw5-w5jj-pvcg: Pip/aiohttp vulnerability
Summary
An attacker can exhaust file descriptors with specially crafted multipart requests.
Impact
If a handler uses Request.post(), it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using aiohttp handlers that call Request.post() are exposed to specially crafted multipart requests that can consume file descriptors. The provided information does not establish whether handlers that do not use Request.post() are affected.
What does an attacker need to do to exploit it?
An attacker needs to send specially crafted multipart requests to a vulnerable handler. The issue can cause use of an unlimited number of file descriptors, leading to resource exhaustion.