Skip to content
Heist/ feed
Back to feed
High

Denial of service when trying to parse malformed POST requests in aiohttp

Type: advisorySources: OSV

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2024-30251
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 03:12 UTC · Revision 1

Source evidence

Denial of service when trying to parse malformed POST requests in aiohttp

core-osv · Original source

Published 2 May 2024, 13:55 UTC

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.

osv:CVE-2024-30251
Complete source record
{
  "id": "689544a377c0bf3e5eaf3fc295c7c009ead81bc640b5cb5adaa1bab618e6513f",
  "url": "https://osv.dev/vulnerability/CVE-2024-30251",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Denial of service when trying to parse malformed POST requests in aiohttp",
    "summary": "aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.",
    "evidence": "osv:CVE-2024-30251",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2024-30251",
      "aliases": [
        "CVE-2024-30251",
        "GHSA-5m98-qgg9-wh84",
        "PYSEC-2026-1098"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/aio-libs/aiohttp",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "b3397c7ac44fc80206d28f1dd0d1f3b10c4ec572"
                },
                {
                  "fixed": "7eecdff163ccf029fbb1ddc9de4169d4aaeb6597"
                },
                {
                  "fixed": "cebe526b9c34dc3a3da9140409db63014bc4cf19"
                },
                {
                  "fixed": "f21c6f2ca512a026ce7f0f6c6311f62d6a638866"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.9.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "7eecdff163ccf029fbb1ddc9de4169d4aaeb6597"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "cebe526b9c34dc3a3da9140409db63014bc4cf19"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "f21c6f2ca512a026ce7f0f6c6311f62d6a638866"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.9.3",
            "v3.9.2",
            "v3.9.1",
            "v3.9.0",
            "v3.9.0rc0",
            "v3.9.0b1",
            "v3.9.0b0",
            "v3.8.0",
            "v3.7.1",
            "v3.7.0",
            "v3.7.0b1",
            "v3.7.0b0",
            "v3.6.2",
            "v3.6.2a2",
            "v3.6.2a1",
            "v3.6.1",
            "v3.6.1b4",
            "v3.6.1b3",
            "v3.6.0",
            "v3.6.0b0",
            "v3.6.0a12",
            "v3.6.0a11",
            "v3.6.0a10",
            "v3.6.0a9",
            "v3.6.0a8",
            "v3.6.0a7",
            "v3.6.0a6",
            "v3.6.0a5",
            "v3.6.0a4",
            "v3.6.0a3",
            "v3.6.0a2",
            "v3.6.0a1",
            "v3.6.0a0",
            "v3.5.4",
            "v3.5.3",
            "v3.5.2",
            "v3.5.1",
            "v3.5.0",
            "v3.5.0b3",
            "v3.5.0b2",
            "v3.5.0b1",
            "v3.5.0a1",
            "v3.4.0",
            "v3.4.0b2",
            "v3.4.0b1",
            "v3.4.0a3",
            "v3.4.0a0",
            "v3.2.0",
            "v3.1.0",
            "v3.0.0b4",
            "v3.0.0b3",
            "v3.0.0b2",
            "v3.0.0b1",
            "v3.0.0b0",
            "v2.3.0",
            "v2.3.0a4",
            "v2.3.0a3",
            "v2.3.0a2",
            "v2.3.0a1",
            "v2.2.0",
            "v2.1.0",
            "2.0.0",
            "2.0.0rc1",
            "1.3.0",
            "v1.2.0",
            "v1.1.1",
            "v1.1.0",
            "v1.0.1",
            "v1.0.0",
            "v0.22.1",
            "v0.22.0",
            "v0.22.0b6",
            "v0.22.0b5",
            "v0.22.0b4",
            "v0.22.0b3",
            "v0.22.0b2",
            "v0.22.0b1",
            "v0.22.0b0",
            "4v0.21.6",
            "v0.21.0",
            "v0.20.1",
            "v0.20.0",
            "v0.19.0",
            "v0.18.0",
            "v0.17.0",
            "v0.16.3",
            "v0.16.2",
            "v0.16.1",
            "v0.16.0",
            "v0.15.3",
            "0.15.2",
            "v0.15.2",
            "v0.15.1",
            "v0.15.0",
            "v0.14.4",
            "v0.14.3",
            "v0.14.2",
            "v0.14.1",
            "v0.14.0",
            "v0.13.1",
            "v0.13.0",
            "v0.12.0",
            "v0.11.0",
            "v0.10.1",
            "v0.10.0",
            "v0.9.2",
            "v0.9.1",
            "v0.9.0",
            "v0.8.4",
            "v0.8.3",
            "0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.3",
            "v0.7.2",
            "v0.7.1",
            "v0.7.0",
            "v.0.6.5",
            "v0.6.4",
            "v0.6.3",
            "v0.6.2",
            "v0.6.1",
            "v0.5.0",
            "v0.4.2",
            "v0.4.1",
            "v0.4",
            "v0.3",
            "v0.2",
            "v0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-30251.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.511869186Z",
      "provider": "osv",
      "references": [
        "https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30251.json",
        "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-30251",
        "https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597",
        "https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19",
        "https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-835"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30251.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-30251",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 522103,
  "published_at": "2024-05-02T13:55:06.135+00:00"
}