Read the docs
TI-2026-49351 Aliases CVE-2026-70646GHSA-7m8f-hgjq-8gc9

aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00636 50th percentileScored 2026-11-07
Fix Fixed aiosend (vovchic17): 3.0.6aiosend (PyPI): 3.0.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vovchic17aiosendbefore 3.0.63.0.6Patch availableCNA
—aiosend (PyPI)before 3.0.73.0.7Patch availableGHSA-7m8f-hgjq-8gc9
  • aiosend Vendorvovchic17 Affected before 3.0.6 Fixed in 3.0.6 Patch available CNA
  • aiosend (PyPI) Vendor— Affected before 3.0.7 Fixed in 3.0.7 Patch available GHSA-7m8f-hgjq-8gc9

Remediation

  • Fix · CNA aiosend (vovchic17) Fixed in 3.0.6
  • Fix · GHSA-7m8f-hgjq-8gc9 aiosend (PyPI) Fixed in 3.0.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-70646
  2. 2026-10-03 Alias added: GHSA-7m8f-hgjq-8gc9
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences