CVE-2024-52303

ADVISORY - github

Summary

A memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry.

Impact

If the user is making use of any middlewares with aiohttp.web then it is advisable to upgrade immediately.

An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests.

Patch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936

EPSS Score⁠: 0.00291 (0.522)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-772⁠

Missing Release of Resource after Effective Lifetime

ADVISORY - github

CWE-772⁠

Missing Release of Resource after Effective Lifetime

ADVISORY - gitlab

CWE-1035⁠

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

CWE-772⁠

Missing Release of Resource after Effective Lifetime

CWE-937⁠

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

ADVISORY - redhat

CWE-772⁠

Missing Release of Resource after Effective Lifetime

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.