8.7

CVE-2024-52303: aio-libs aiohttp

CVSS: 8.7v4.0HighAnalyzed
AliasesGHSA-27mf-ghqm-j3j8PYSEC-2026-1096UBUNTU-CVE-2024-52303
Published 18-11-2024Last modified 19-11-2024
Open JSON

Vulnerability summary

CVE-2024-52303 is a high (CVSS 8.7) vulnerability in aio-libs aiohttp. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.3% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
0.59%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 4
CGA-48J3-HQPV-G3Q7CGA-5WQX-GWJC-M857CGA-MFCX-VCVM-458RCGA-V257-CQC3-WRVF

Timeline

  1. 18-11-2024
    PublishedVulnerability first disclosed.
  2. 19-11-2024
    Last modifiedVulnerability information updated.

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.

CVSS metrics

11 scores · 7 sources · 2 versions

EPSS trend

Probability

0.59%

Chance of exploitation in the next 30 days

Percentile

47%

Versus all other CVEs

30-day change

0.00 pp

From 0.59% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.59%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard4 products
  • airflow< 2.10.3-r2
  • airflow-bitnami-compat< 2.10.3-r2
  • checkov< 3.2.432-r0
  • py3-aiohttp< 3.10.11-r0
Wolfi4 products
  • airflow< 2.10.3-r2
  • airflow-bitnami-compat< 2.10.3-r2
  • checkov< 3.2.432-r0
  • py3-aiohttp< 3.10.11-r0
Aio-libs1 product
Aiohttp1 product
Debian1 product
  • python-aiohttp< 3.10.11-1
Opensuse1 product
  • python-aiohttp&distro=openSUSE Tumbleweed< 3.11.9-1.1
PyPI1 product
  • aiohttp≥ 3.10.6, < 3.10.11
Ubuntu1 product
  • python-aiohttpAll versions (No fix recorded) | < 3.10.11-1build1

8 vendors · 14 products

References

11 links
Show all 11 references