Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 02 May 2024 14:48:19 +0100
From: Sam Bull <>
Subject: CVE-2024-30251: DoS in aiohttp

Aiohttp is an HTTP client and server-side web framework in Python. This issue only affects
users of the server-side web framework. We've not seen any evidence of this being
exploited in the wild yet, and fixes were already included in the 3.9.4 and 3.9.5

### Summary
An attacker can send a specially crafted POST (multipart/form-data) request. When the
aiohttp server processes it, the server will enter an infinite loop and be unable to
process any further requests.

### Impact
An attacker can stop the application from serving requests after sending a single request.


For anyone needing to patch older versions of aiohttp, the minimum diff needed to resolve
the issue is (located in `_read_chunk_from_length()`):

   diff --git a/aiohttp/ b/aiohttp/
   index 227be605c..71fc2654a 100644
   --- a/aiohttp/
   +++ b/aiohttp/
   @@ -338,6 +338,8 @@ class BodyPartReader:
            assert self._length is not None, "Content-Length required for chunked read"
            chunk_size = min(size, self._length - self._read_bytes)
            chunk = await
   +        if self._content.at_eof():
   +            self._at_eof = True
            return chunk
        async def _read_chunk_from_stream(self, size: int) -> bytes:

This does however introduce some very minor issues with handling form data. So, if
possible, it would be recommended to also backport the changes in:

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.