REDHAT-BUG-2510825: High severity aiohttp aiohttp vulnerability
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/httpparser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using aiohttp as an HTTP client are exposed when they process malformed responses from an attacker-controlled server. The issue can also be triggered by an accidental malformed response.
What must an attacker do to trigger the denial of service?
An attacker needs to cause the aiohttp client to parse a malformed response, including malformed chunked responses or malformed request or response bytes at the end of a buffer. The vulnerable code path is reached while constructing an error-message snippet in the C response parser.
What version resolves the issue?
The issue is fixed in aiohttp version 3.14.3. Versions prior to 3.14.3 are affected.