Live › vulnerability › GHSA-2g87-pp6c-29x5
Go to dashboardaiohttp, a Python async HTTP library, can use unbounded memory or excessive CPU when handling attacker-crafted requests. An attacker can exhaust server resources and degrade or crash the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aiohttp | pypi | <= 3.14.3 | 3.14.4 |
Run pip show aiohttp or pip freeze | grep aiohttp to read the installed version; affected if 3.14.3 or lower.
Upgrade aiohttp to 3.14.4 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests.
An attacker could cause resource exhaustion through specially crafted requests.
This page as .md · .json · in your agent: get_signal("GHSA-2g87-pp6c-29x5")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.