CVE-2026-34513: 
Wolfi vulnerability analysis and mitigation

CVE-2026-34513 is a Denial of Service (DoS) vulnerability in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, caused by an unbounded DNS cache in the TCPConnector component. All versions up to and including 3.13.3 are affected; the issue was patched in version 3.13.4. The vulnerability was reported by researcher gonas0919, published on March 31, 2026, and assigned a CVE on April 1, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 2.7 (Low), reflecting limited practical impact under typical conditions (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The _DNSCacheTable class within aiohttp/connector.py used a plain dictionary (Dict) with no upper bound on the number of entries, allowing the cache to grow indefinitely as new hostnames were resolved. An attacker or a workload that causes an aiohttp client to make requests to a very large number of distinct hosts can trigger unbounded memory growth. The fix (commit c4d77c3) converted the internal dictionary to an OrderedDict implementing an LRU eviction policy, and added a dns_cache_max_size parameter (defaulting to 1000) to TCPConnector to cap cache size (Github Advisory, Patch Commit).

Successful exploitation results in excessive memory consumption by the aiohttp process, potentially causing the application to become unresponsive or crash due to memory exhaustion — a Denial of Service condition. There is no impact on confidentiality or integrity; only availability is affected. The vulnerability is most impactful in applications that act as HTTP clients contacting a large and continuously growing set of unique hostnames, such as web crawlers or proxy services (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.02% (6th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to influence the set of hosts an aiohttp client contacts, making it more relevant to specific application architectures than to general-purpose attacks (Github Advisory).

Upgrade aiohttp to version 3.13.4 or later, which introduces a bounded LRU DNS cache with a default maximum size of 1000 entries via the new dns_cache_max_size parameter on TCPConnector (aiohttp Release). As a temporary workaround prior to patching, consider implementing application-level controls to limit the number of unique hosts the application contacts, or configure DNS caching at the system/OS level. IBM has also released interim fixes for affected products including IBM Process Mining, IBM API Connect, IBM watsonx Code Assistant On Prem, and IBM Observability with Instana (IBM Process Mining Fix, IBM API Connect Fix).