CVE-2024-23829

CVSS 3.1 Score 6.5 of 10 (medium)

Details

Published Jan 29, 2024
Updated: Feb 9, 2024
CWE ID 444

Summary

CVE-2024-23829 is a vulnerability that affects aiohttp, an asynchronous HTTP client/server framework for asyncio and Python. This vulnerability exists due to an incomplete fix for CVE-2023-47627. The security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, which could trigger error handling and potentially assist in request smuggling. Additionally, validation could cause unhandled exceptions, leading to excessive resource consumption on the application server and its logging facilities. The vulnerability has a base severity of MEDIUM, with a base score of 6.5 according to CVSS:3.1. The recommended remediation is to update to version 3.9.2 of aiohttp.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-23829 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options