CVE-2024-52303: aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

November 18, 2024 (updated November 19, 2024)

A memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry.

References

github.com/advisories/GHSA-27mf-ghqm-j3j8
github.com/aio-libs/aiohttp
github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936
github.com/aio-libs/aiohttp/security/advisories/GHSA-27mf-ghqm-j3j8
nvd.nist.gov/vuln/detail/CVE-2024-52303

Code Behaviors & Features

Detect and mitigate CVE-2024-52303 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →