Executive brief
aiohttp is a popular Python HTTP client and server library. When middleware is enabled and a request uses an HTTP method not allowed for a resource, a memory leak occurs due to improper cache cleanup. An attacker can exploit this by sending hundreds of thousands to millions of such requests, exhausting server memory and causing service unavailability.
Technical details
This vulnerability is a resource leak (CWE-772) that occurs when a MatchInfoError is generated in response to requests with non-allowed HTTP methods on resources when middleware is active. The root cause is improper cache management—each unique MatchInfoError produces a new cache entry that is never freed, causing unbounded memory growth. The attack is unauthenticated and requires only network access; an attacker can trigger many cache entries by sending repeated requests with various disallowed HTTP methods. An attacker can achieve denial of service by exhausting available memory on the server. The vulnerability was fixed in version 3.10.11 (commit bc15db6).
Affected products
- aio-libs aiohttp 3.10.6 through 3.10.10
Timeline
- 2024-11-18: disclosed
- 2024-11-18: patched: Version 3.10.11 released with fix