ByteOS Network

NVD Vulnerability Details :

CVE-2024-30251

Analyzed

Source-security-advisories@github.com

Published At-02 May, 2024 | 14:15

Updated At-21 Aug, 2025 | 15:23

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CPE Matches

aiohttp>>aiohttp>>Versions before 3.9.4(exclusive)

cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-835	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
http://www.openwall.com/lists/oss-security/2024/05/02/4	security-advisories@github.com	Mailing List
https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597	security-advisories@github.com	Patch
https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19	security-advisories@github.com	Patch
https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866	security-advisories@github.com	Patch
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84	security-advisories@github.com	Vendor Advisory Patch
http://www.openwall.com/lists/oss-security/2024/05/02/4	af854a3a-2127-422b-91ae-364da2661108	Mailing List
https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597	af854a3a-2127-422b-91ae-364da2661108	Patch
https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19	af854a3a-2127-422b-91ae-364da2661108	Patch
https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866	af854a3a-2127-422b-91ae-364da2661108	Patch
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory Patch

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History