Denial of Service Vulnerability in aiosend Crypto Pay API Client by Vovchic17
CVE-2026-70646

7.5HIGH

Key Information:

Vendor: Vovchic17
Status: AiOSend
Vendor: CVE Published:; 6 August 2026

What is CVE-2026-70646?

The aiosend Crypto Pay API client, before version 3.0.7, has a vulnerability in the WebhookHandler.feed_update() function that allows unauthenticated attackers to exploit JSON payload processing. This issue arises from deserializing the entire request body without prior HMAC signature verification, ultimately leading to excessive CPU and memory usage due to expensive parsing tasks. Version 3.0.7 addresses this vulnerability, but workarounds such as limiting request body sizes, applying rate limits to webhook endpoints, and rejecting oversized requests can help mitigate the risk.