Infinite Loop Vulnerability Affects aiohttp Server

CVE-2024-30251

What is CVE-2024-30251?

Aiohttp, an asynchronous HTTP client/server framework for Python, is susceptible to an infinite loop vulnerability due to improper request handling. An attacker can exploit this flaw by sending a specially crafted POST (multipart/form-data) request to the server. Upon processing this request, the aiohttp server enters an infinite loop, which prevents it from handling any subsequent requests. This results in a denial of service, where legitimate users are unable to access the application. The issue has been remediated in version 3.9.4, and users are recommended to upgrade to this version. For those unable to update, manual patching is available, along with detailed instructions in the linked security advisory.

References