CyberRota Analysis
AI-GeneratedAIOHTTP versions prior to 3.14.3 are vulnerable to an out-of-bounds heap read in the C response parser, which can be exploited by an attacker-controlled server or through malformed responses, potentially leading to a denial-of-service (DoS) condition in the client. Organizations using AIOHTTP for asynchronous HTTP client/server applications should prioritize upgrading to version 3.14.3 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.