GHSA-cq5v-8q36-5273: Use After Free
Summary
An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.
Impact
An attacker controlled server, or possibly an accidental response could trigger a DoS in the client.
Workaround
If unable to upgrade, the Python parser is unaffected and can be used with AIOHTTPNOEXTENSIONS=1.
---
Patch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.3 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Patch 49f65d54150397892f7bcc4aae887767d51c322d - Configuration
Set environment variable AIOHTTP_NO_EXTENSIONS=1 to use the Python parser (workaround when unable to upgrade), since the Python parser is unaffected.
aiohttp C response parser AIOHTTP_NO_EXTENSIONS = 1