Read the docs
TI-2024-34978 Aliases CVE-2024-52303GHSA-27mf-ghqm-j3j8

aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method

Priority MEDIUM 44CWE-772Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-772.

Summary

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00591 48th percentileScored 2026-11-07
Fix Partial aiohttp (aio-libs): 3.10.11aiohttp (PyPI): 3.10.11Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aio-libsaiohttp3.10.6 to before 3.10.113.10.11Patch availableCNA
—aiohttp (PyPI)3.10.6 to before 3.10.113.10.11Patch availableGHSA-27mf-ghqm-j3j8
  • aiohttp Vendoraio-libs Affected 3.10.6 to before 3.10.11 Fixed in 3.10.11 Patch available CNA
  • aiohttp (PyPI) Vendor— Affected 3.10.6 to before 3.10.11 Fixed in 3.10.11 Patch available GHSA-27mf-ghqm-j3j8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*3.10.6 to before 3.10.11VulnerableAiohttp
  • cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* Versions 3.10.6 to before 3.10.11 Vulnerable ·Aiohttp

Remediation

  • Fix · CNA aiohttp (aio-libs) Fixed in 3.10.11
  • Fix · GHSA-27mf-ghqm-j3j8 aiohttp (PyPI) Fixed in 3.10.11 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI)AffectedNo fix planned: Will not fix
Not affected: 5 products
  • OpenShift Lightspeed
  • Red Hat Ansible Automation Platform 1.2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Satellite 6
  • Red Hat Update Infrastructure 4 for Cloud Providers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52303
  2. 2026-10-03 Alias added: GHSA-27mf-ghqm-j3j8

References

Patch 1

Advisory 2

Other 1

  • TI-2025-38826 aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server CVSS 4.0HIGH 8.2
  • TI-2024-15436 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal CVSS 3.1HIGH 7.5
  • TI-2023-25769 Request smuggling in aiohttp CVSS 3.1HIGH 7.5
  • TI-2023-18906 aiohttp vulnerable to HTTP request smuggling CVSS 3.1HIGH 7.5
  • TI-2023-26746 aiohttp's ClientSession is vulnerable to CRLF injection via version CVSS 3.1HIGH 7.2
  • TI-2026-66145 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction CVSS 3.1MEDIUM 5.3
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences