CVE-2024-52303

Summary

CVE-2024-52303 is a memory leak vulnerability affecting versions 3.10.6 and below of aiohttp, an asynchronous HTTP client/server framework for Python and asyncio. This issue arises when a MatchInfoError is produced during a request, leading to the creation of a new cache entry. Malicious actors may exploit this flaw by overwhelming a server with large numbers of requests (up to hundreds of thousands or even millions) that generate MatchInfoErrors, causing the server's memory to be exhausted. To mitigate this risk, users of aiohttp.web should upgrade to version 3.10.11 to apply the available patch.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.