CVE-2024-52303

Name of the Vulnerable Software and Affected Versions aiohttp versions 3.10.6 through 3.10.10

Description A memory leak can occur when a request produces a MatchInfoError. This issue is caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests.

Recommendations For aiohttp versions 3.10.6 through 3.10.10, upgrade to version 3.10.11 to receive a patch. As a temporary workaround, consider restricting the number of requests that can produce a MatchInfoError to minimize the risk of exploitation.