Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-52303
CVE-2024-52303:
Wolfi vulnerability analysis and mitigation
Overview
aiohttp, an asynchronous HTTP client/server framework for asyncio and Python, contains a memory leak vulnerability (CVE-2024-52303) in versions starting with 3.10.6 and prior to 3.10.11. The vulnerability was discovered and disclosed on November 18, 2024, affecting systems using middlewares with aiohttp.web (GitHub Advisory).
Technical details
The vulnerability occurs when a request produces a MatchInfoError, causing a memory leak by adding an entry to a cache on each request. This happens because the building of each MatchInfoError produces a unique cache entry. The vulnerability has received a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).
Impact
An attacker can potentially exhaust the memory resources of a server by sending a substantial number (hundreds of thousands to millions) of requests that trigger the MatchInfoError condition. This can lead to a denial-of-service condition affecting the availability of the server (GitHub Advisory).
Mitigation and workarounds
Users who utilize any middlewares with aiohttp.web should upgrade to version 3.10.11, which contains the patch for this vulnerability. The fix was implemented in commit bc15db6 to prevent system routes from polluting the middleware cache (GitHub Commit).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management