Skip to content
fr Sign in
7.5 High

CVE-2024-30251 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.

Affected products and versions

Product Affected versions Fixed in
aiohttp 3.9 earliest → < 3.9.4 3.9.4
aiohttp 3.9 earliest → < 3.9.4 3.9.4

References

Timeline

  1. Published
  2. Last modified

Other CVEs of aiohttp

The 53 CVEs of aiohttp →
CVE-2026-111750 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python 6.3 Medium CVE-2026-111749 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python 2.3 Low CVE-2026-111748 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python 6.3 Medium CVE-2026-111066 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python 8.2 High
Track this CVE