GHSA-27MF-GHQM-J3J8 aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

🗓️ 18 Nov 2024 21:02:17Reported by GoogleType

osv🔗 osv.dev👁 2 Views

A memory leak in aiohttp with middleware on disallowed method requests due to MatchInfoError cache entries; upgrade.

Reporter	Title	Published	Views	Family All 43
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Broker Component uses CVE-2024-52303 aiohttp-3.10.9-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Publicly disclosed vulnerability found by Mend) CVE-2024-52303	28 Jan 202521:51	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	15 Apr 202502:48	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in aio-libs aiohttp affects IIBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.	13 Mar 202516:46	–	ibm
Tenable Nessus	aioHTTP 3.10.6 < 3.10.11 Memory Leak	20 Nov 202400:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2024-52303	18 Aug 202500:00	–	nessus
BDU FSTEC	The vulnerability of the aiohttp HTTP client lies in the fact that resources are not released after their useful period has ended, allowing attackers to trigger service failures.	26 Nov 202400:00	–	bdu_fstec
Chainguard	CVE-2024-52303 vulnerabilities	18 Nov 202420:15	–	cgr
Circl	CVE-2024-52303	18 Nov 202420:10	–	circl
CNNVD	aiohttp 安全漏洞	18 Nov 202400:00	–	cnnvd

Source	Link
github	www.github.com/aio-libs/aiohttp/security/advisories/GHSA-27mf-ghqm-j3j8
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-52303
github	www.github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936
github	www.github.com/aio-libs/aiohttp

07 Jul 2026 17:57Current

7.1High risk

Vulners AI Score7.1

CVSS 46.9

CVSS 3.17.5

EPSS0.00563