Search for packages
| purl | pkg:rpm/redhat/python3x-aiohttp@3.9.5-1?arch=el8ap |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-bhkk-2b7c-wfgr
Aliases: CVE-2024-30251 GHSA-5m98-qgg9-wh84 |
aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests ### Summary An attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. ### Impact An attacker can stop the application from serving requests after sending a single request. ------- For anyone needing to patch older versions of aiohttp, the minimum diff needed to resolve the issue is (located in `_read_chunk_from_length()`): ```diff diff --git a/aiohttp/multipart.py b/aiohttp/multipart.py index 227be605c..71fc2654a 100644 --- a/aiohttp/multipart.py +++ b/aiohttp/multipart.py @@ -338,6 +338,8 @@ class BodyPartReader: assert self._length is not None, "Content-Length required for chunked read" chunk_size = min(size, self._length - self._read_bytes) chunk = await self._content.read(chunk_size) + if self._content.at_eof(): + self._at_eof = True return chunk async def _read_chunk_from_stream(self, size: int) -> bytes: ``` This does however introduce some very minor issues with handling form data. So, if possible, it would be recommended to also backport the changes in: https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19 https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597 https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866 | There are no reported fixed by versions. |
|
VCID-tn28-662n-vug8
Aliases: CVE-2024-27306 GHSA-7gpw-8wmc-pm8g |
aiohttp Cross-site Scripting vulnerability on index pages for static file handling ### Summary A XSS vulnerability exists on index pages for static file handling. ### Details When using `web.static(..., show_index=True)`, the resulting index pages do not escape file names. If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks. ### Workaround We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade. ----- Patch: https://github.com/aio-libs/aiohttp/pull/8319/files | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T13:48:06.557025+00:00 | RedHat Importer | Affected by | VCID-tn28-662n-vug8 | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27306.json | 38.0.0 |
| 2026-04-01T13:47:54.759063+00:00 | RedHat Importer | Affected by | VCID-bhkk-2b7c-wfgr | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-30251.json | 38.0.0 |