{"id":"CVE-2024-52303","aliases":["GHSA-27mf-ghqm-j3j8","PYSEC-2026-1096"],"url":"https://o3.security/vulnerability/CVE-2024-52303","summary":"aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method","details":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.","published":"2024-11-18T20:08:15.387Z","modified":"2026-08-08T03:48:07.904823274Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"aiohttp","fixedVersion":"3.10.11"}],"fix":{"url":"https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936","label":"aio-libs/aiohttp@bc15db6"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52303.json"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-27mf-ghqm-j3j8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52303"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:48:07.904823274Z"}}