aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with     3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was     caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing     a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a     substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web     should upgrade to version 3.10.11 to receive a patch. (CVE-2024-52303)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with
    3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was
    caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing
    a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a
    substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web
    should upgrade to version 3.10.11 to receive a patch. (CVE-2024-52303)

The version of aioHTTP installed on the remote host is prior to 3.10.11. It is, therefore, affected by a memory leak vulnerability. aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
251574	Linux Distros Unpatched Vulnerability : CVE-2024-52303	Nessus	Misc.	high
408769	SCA: security update for aiohttp (GHSA-27mf-ghqm-j3j8)	Tenable Cloud Security	SCA Checks	high
408769	SCA: security update for aiohttp (GHSA-27mf-ghqm-j3j8)	Tenable Self-Hosted Container Security	SCA Checks	high
211644	aioHTTP 3.10.6 < 3.10.11 Memory Leak	Nessus	Misc.	high

Detections

Analytics

CVE-2024-52303

high

Tenable Plugins

high

high

high

high