GHSA-7m8f-hgjq-8gc9: aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

May 22, 2026 (updated August 6, 2026)

WebhookHandler.feed_update() deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption.

References

github.com/advisories/GHSA-7m8f-hgjq-8gc9
github.com/vovchic17/aiosend/commit/db20f0a742209dfac181863d398ec5112687efa4
github.com/vovchic17/aiosend/releases/tag/v3.0.7
github.com/vovchic17/aiosend/security/advisories/GHSA-7m8f-hgjq-8gc9
nvd.nist.gov/vuln/detail/CVE-2026-70646

Code Behaviors & Features

Detect and mitigate GHSA-7m8f-hgjq-8gc9 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →