CVE-2024-23829
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Summary
CVE-2024-23829 is a vulnerability that affects aiohttp, an asynchronous HTTP client/server framework for asyncio and Python. This vulnerability exists due to an incomplete fix for CVE-2023-47627. The security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, which could trigger error handling and potentially assist in request smuggling. Additionally, validation could cause unhandled exceptions, leading to excessive resource consumption on the application server and its logging facilities. The vulnerability has a base severity of MEDIUM, with a base score of 6.5 according to CVSS:3.1. The recommended remediation is to update to version 3.9.2 of aiohttp.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions