REDHAT-BUG-2427254: Medium severity pypi/aiohttp vulnerability
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.13.3
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2427254?
The severity of REDHAT-BUG-2427254 is medium with a score of 4.
How do I fix REDHAT-BUG-2427254?
To fix REDHAT-BUG-2427254, update AIOHTTP to version 3.13.3 or later.
What versions of AIOHTTP are affected by REDHAT-BUG-2427254?
AIOHTTP versions 3.13.2 and below are affected by REDHAT-BUG-2427254.
What type of vulnerability is REDHAT-BUG-2427254?
REDHAT-BUG-2427254 is a resource exhaustion vulnerability that can lead to uncontrolled memory consumption.
Does REDHAT-BUG-2427254 affect all applications using AIOHTTP?
REDHAT-BUG-2427254 primarily affects applications with a handler that utilizes the Request.post() method.